title: how to preserve a variable value and use it globally in logstash
body: <p>I have a variable 'worflow' in the code and once any event matches that filter I want to preserve it for next events as it is.
  Problem - By using 'add field', for the event which actually contains workflow the value of workflow is displayed in csv, but for other events %{workflow} (as it is ) is displayed.
  Please suggest any way for this.</p>
  
  <pre><code>input { 
      file{
          path =&gt; "D:/alerts extracted from mails/*.log"
          start_position =&gt; beginning
          sincedb_path=&gt;"NUL"
      }
  }
  filter {
     grok{
   match=&gt; {"message" =&gt; "(?&lt;mess_time&gt;%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR}) : %{DATA:Title}&gt; %{WORD:Code} Workflow: (\[%{WORD:workflow}\]) %{GREEDYDATA:info}"}
   match=&gt; {"message" =&gt; "(?&lt;mess_time&gt;%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR}) : %{DATA:Title}&gt; %{WORD:Code} %{GREEDYDATA:info}"}
  }
  
  if "_grokparsefailure" in [tags]{
       drop { }
       }
       mutate {
  
          add_field =&gt; { "client_id" =&gt; "BP" }
          add_field =&gt; { "portfolio_id" =&gt; "NAGP" }
          add_field =&gt; { "resource_id" =&gt; " " }
          add_field =&gt; { "resource_name" =&gt; "%{workflow}" }
          add_field =&gt; { "lob" =&gt; "creditrisk" }
          add_field =&gt; { "mess" =&gt; "%{info} }
      }
      }
  
  output{
  
  csv{
  
  fields =&gt;["client_id","portfolio_id","resouce_id","resource_name","lob","mess_time","mess"]
  path =&gt; "C:/Users/saavi.verma/Downloads/logstash-7.6.2/output_files/output1.csv"
  }
  }
  </code></pre>