title: Adding fields depending on event message in Logstash not working
body: <p>I have ELK installed and working in my machine, but now I want to do a more complex filtering and field adding depending on event messages.</p>
  
  <p>Specifically, I want to set "id_error" and "descripcio" depending on the message pattern.</p>
  
  <p>I have been trying a lot of code combinations in "logstash.conf" file, but I am not able to get the expected behavior.</p>
  
  <p>Can someone tell me what I am doing wrong, what I have to do or if this is not possible? Thanks in advance.</p>
  
  <p>This is my "logstash.conf" file, with the last test I have made, resulting in no events captured in Kibana:</p>
  
  <pre><code>input { 
      file {
          path =&gt; "C:\xxx.log"
      }
  }
  
  filter {
      grok {
          patterns_dir =&gt; "C:\elk\patterns"
          match =&gt; [ "message", "%{ERROR2:error2}" ]
          add_field =&gt; [ "id_error", "2" ]
          add_field =&gt; [ "descripcio", "error2!!!" ]
      }
      grok {
          patterns_dir =&gt; "C:\elk\patterns"
          match =&gt; [ "message", "%{ERROR1:error1}" ]
          add_field =&gt; [ "id_error", "1" ]
          add_field =&gt; [ "descripcio", "error1!!!" ]
      }
      if ("_grokparsefailure" in [tags]) { drop {} }
  }
  
  output {
    elasticsearch {
      host =&gt; "localhost"
      protocol =&gt; "http"
      index =&gt; "xxx-%{+YYYY.MM.dd}"
    }
  }
  </code></pre>
  
  <p>I also have tried the following code, resulting in fields "id_error" and "descripcio" with both vaules "[1,2]" and "[error1!!!,error2!!!]" respectively, in each matched event.</p>
  
  <p>As "break_on_match" is set "true" by default, I expect getting only the fields behind the matching clause, but this doesn't occur.</p>
  
  <pre><code>input { 
    file {
      path =&gt; "C:\xxx.log"
    }
  }
  
  filter {
    grok {
      patterns_dir =&gt; "C:\elk\patterns"
      match =&gt; [ "message", "%{ERROR1:error1}" ]
      add_field =&gt; [ "id_error", "1" ]
      add_field =&gt; [ "descripcio", "error1!!!" ]
      match =&gt; [ "message", "%{ERROR2:error2}" ]
      add_field =&gt; [ "id_error", "2" ]
      add_field =&gt; [ "descripcio", "error2!!!" ]
    }
    if ("_grokparsefailure" in [tags]) { drop {} }
  }
  
  output {
    elasticsearch {
      host =&gt; "localhost"
      protocol =&gt; "http"
      index =&gt; "xxx-%{+YYYY.MM.dd}"
    }
  }
  </code></pre>