title: Grok returns array instead of single string
body: <p>I'm new to grok and I have run into this issue that I just don't know how to solve.</p>
  
  <p>Below is my grok match:</p>
  
  <pre><code>grok {
        match =&gt; { "source" =&gt; "/var/log/nginx/sites/\b\w+\b/\b\w+\b/\b\w+\b/%{DATA:uuid}/" }
      }
  
      mutate {
        add_field =&gt; {
          "read_timestamp" =&gt; "%{@timestamp}"
          "token" =&gt; "%{[fields][token]}"
          "logzio_codec" =&gt; "%{[fields][logzio_codec]}"
          "uuid" =&gt; "%{uuid}"
          "type" =&gt; "%{[fields][type]}"
          "category" =&gt; "%{[fields][category]}"
        }
      }
  </code></pre>
  
  <p>for some reason, the uuid is matched and resulted in array of 2 uuid (duplicated values). Instead of <code>uuid_string</code> I get [<code>uuid_string</code>, <code>uuid_string</code>]</p>
  
  <p>I tried on <a href="https://grokdebug.herokuapp.com/" rel="nofollow noreferrer">https://grokdebug.herokuapp.com/</a> and got what I expected so I wonder what is wrong?</p>