Adding fields depending on event message in Logstash not working <p>I have ELK installed and working in my machine, but now I want to do a more complex filtering and field adding depending on event messages.</p> <p>Specifically, I want to set "id_error" and "descripcio" depending on the message pattern.</p> <p>I have been trying a lot of code combinations in "logstash.conf" file, but I am not able to get the expected behavior.</p> <p>Can someone tell me what I am doing wrong, what I have to do or if this is not possible? Thanks in advance.</p> <p>This is my "logstash.conf" file, with the last test I have made, resulting in no events captured in Kibana:</p> <pre><code>input { file { path =&gt; "C:\xxx.log" } } filter { grok { patterns_dir =&gt; "C:\elk\patterns" match =&gt; [ "message", "%{ERROR2:error2}" ] add_field =&gt; [ "id_error", "2" ] add_field =&gt; [ "descripcio", "error2!!!" ] } grok { patterns_dir =&gt; "C:\elk\patterns" match =&gt; [ "message", "%{ERROR1:error1}" ] add_field =&gt; [ "id_error", "1" ] add_field =&gt; [ "descripcio", "error1!!!" ] } if ("_grokparsefailure" in [tags]) { drop {} } } output { elasticsearch { host =&gt; "localhost" protocol =&gt; "http" index =&gt; "xxx-%{+YYYY.MM.dd}" } } </code></pre> <p>I also have tried the following code, resulting in fields "id_error" and "descripcio" with both vaules "[1,2]" and "[error1!!!,error2!!!]" respectively, in each matched event.</p> <p>As "break_on_match" is set "true" by default, I expect getting only the fields behind the matching clause, but this doesn't occur.</p> <pre><code>input { file { path =&gt; "C:\xxx.log" } } filter { grok { patterns_dir =&gt; "C:\elk\patterns" match =&gt; [ "message", "%{ERROR1:error1}" ] add_field =&gt; [ "id_error", "1" ] add_field =&gt; [ "descripcio", "error1!!!" ] match =&gt; [ "message", "%{ERROR2:error2}" ] add_field =&gt; [ "id_error", "2" ] add_field =&gt; [ "descripcio", "error2!!!" ] } if ("_grokparsefailure" in [tags]) { drop {} } } output { elasticsearch { host =&gt; "localhost" protocol =&gt; "http" index =&gt; "xxx-%{+YYYY.MM.dd}" } } </code></pre>