title: Logstash matches multiple value
body: <p><strong>1)</strong> This is my <strong>logstash.conf</strong> file</p>
  
  <pre><code>input {
    beats {
      type =&gt; beats
      port =&gt; 5044
    }
  }
  
  filter {
    grok {
      match =&gt; { "message" =&gt; "\[(?&lt;logtime&gt;([0-9]|[\-\+\.\:\ ])*)\] \[(?&lt;level&gt;([a-z-A-Z])*)\] \[(?&lt;msg&gt;(.)+)\] (?&lt;exception&gt;(.)+)" }
    }
    mutate {
      add_field =&gt; [ "logtime", "level", "msg", "exception" ]
      remove_field =&gt; [ "beat", "offset", "source", "prospector", "host", "tags" ]
    }  
  }
  
  output {
    if [type] == "beats"{
      elasticsearch {
        hosts =&gt; "localhost:9200"
        manage_template =&gt; false
        index =&gt; "%{+YYYY.MM.dd}-container.api" 
        document_type =&gt; "%{[@metadata][type]}" 
        user =&gt; "elastic"
        password =&gt; "secret"
      }
    }
  }
  </code></pre>
  
  <p><strong>2)</strong> I tested my grok with the debugger as you see below</p>
  
  <p><a href="https://i.stack.imgur.com/T4SRa.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/T4SRa.png" alt="enter image description here"></a></p>
  
  <p><strong>3)</strong> This is what logstash writes to elasticsearch</p>
  
  <pre><code>  {
      "_index": "2019.01.28-container.api",
      "_type": "doc",
      "_id": "pZctlWgBojxJzDZGWqZz",
      "_score": 1,
      "_source": {
        "type": "beats",
        "level": "Debug",
        "@timestamp": "2019-01-28T15:56:41.295Z",
        "msg": [
          "Hosting starting",
          "exception"
        ],
        "@version": "1",
        "logtime": [
          "2019-01-28 15:23:12.911 +03:00",
          "level"
        ],
        "message": "[2019-01-28 15:23:12.911 +03:00] [Debug] [Hosting starting] exception 2",
        "exception": "exception 2",
        "input": {
          "type": "log"
        }
      }
    }
  </code></pre>
  
  <p><strong>4)</strong> What I want to see is</p>
  
  <pre><code>  {
      "_index": "2019.01.28-container.api",
      "_type": "doc",
      "_id": "pZctlWgBojxJzDZGWqZz",
      "_score": 1,
      "_source": {
        "type": "beats",
        "level": "Debug",
        "@timestamp": "2019-01-28T15:56:41.295Z",
        "msg": "Hosting starting",
        "logtime": "2019-01-28 15:23:12.911 +03:00",
        "message": "2019-01-28 15:23:12.911 +03:00 Debug Hosting starting [exception 2]",
        "exception": "exception 2"
      }
    }
  </code></pre>