logstash add_field and remove_field <p>I'm attempting to simplify my logstash config. I want to split the program field into separate fields (as show below) however I would prefer to use just one grok statement (if it's at all possible!)</p> <p>Of the two examples below I get an _grokparsefailure on the second example, but not the first. Since grok has the add_field and remove_field options I would assume that I could combine it all into one grok statement. Why is this not the case? Have I missed some ordering/syntax somewhere?</p> <p>Sample log:</p> <pre><code>2016-02-16T16:42:06Z ubuntu docker/THISTESTNAME[892]: 172.16.229.1 - - [16/Feb/2016:16:42:06 +0000] "GET / HTTP/1.1" 304 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.109 Safari/537.36" "-" </code></pre> <p>Why does this work:</p> <pre><code>filter { # Extracts the docker name, ID, image etc elements mutate { add_field =&gt; { "[@metadata][program]" =&gt; "%{program}" } remove_field =&gt; "[program]" } grok { patterns_dir =&gt; "/logstash/patterns_dir/docker" match =&gt; { "[@metadata][program]" =&gt; "%{D_ID}" } } } </code></pre> <p>But this does not:</p> <pre><code>filter { grok { add_field =&gt; { "[@metadata][program]" =&gt; "%{program}" } remove_field =&gt; "[program]" patterns_dir =&gt; "/logstash/patterns_dir/docker" match =&gt; { "[@metadata][program]" =&gt; "%{D_ID}" } } } </code></pre>