title: Prevent _grokparsefailure if one of the multipe groks match
body: <p>I have this grok:</p>
  
  <pre><code>grok {
          patterns_dir =&gt; "/etc/logstash/patterns/"
          break_on_match =&gt; false
          keep_empty_captures =&gt; true
  
          match =&gt; [ 
              "message", "(%{EXIM_DATE:exim_date} )(%{EXIM_PID:exim_pid} )(%{EXIM_MSGID:exim_msg_id} )(%{EXIM_FLAGS:exim_flags} )(%{GREEDYDATA})",
              "message", "(%{EXIM_MSGID} )(&lt;= )(%{NOTSPACE:env_sender} )(%{EXIM_REMOTE_HOST} )?(%{EXIM_INTERFACE} )?(%{EXIM_PROTOCOL} )?(X=%{NOTSPACE:tls_info} )?(%{EXIM_MSG_SIZE} )?(%{EXIM_HEADER_ID} )?(%{EXIM_SUBJECT})",
              "message", "(%{EXIM_MSGID} )([=-]&gt; )(%{NOTSPACE:env_rcpt} )(&lt;%{NOTSPACE:env_rcpt_outer}&gt; )?(R=%{NOTSPACE:exim_router} )(T=%{NOTSPACE:exim_transport} )(%{EXIM_REMOTE_HOST} )(X=%{NOTSPACE:tls_info} )?(QT=%{EXIM_QT:exim_qt})",
              "message", "(%{EXIM_DATE:exim_date} )(%{EXIM_PID:exim_pid} )(%{EXIM_MSGID:exim_msg_id} )(Completed )(QT=%{EXIM_QT:exim_qt})",
              "message", "(%{EXIM_DATE:exim_date} )(%{EXIM_PID:exim_pid} )(%{EXIM_MSGID:exim_msg_id} )?(%{EXIM_REMOTE_HOST} )?(%EXIM_INTERFACE} )?(F=&lt;%{NOTSPACE:env_sender}&gt; )?(.+(rejected after DATA|rejected \(but fed to sa-learn\)|rejected [A-Z]+ (or [A-Z]+ %{NOTSPACE}?|&lt;%{NOTSPACE:env_rcpt}&gt;)?): (?&lt;exim_rej_reason&gt;.+))"
          ]
        }
  </code></pre>
  
  <p>If I test the grok patterns individually everything works as expected, but in production with multiple matches they do not. The result is OK, I got everything parsed, but I got every time a <code>_grokparsefailure</code> tag, also if one of the 5 is a match. How do I prevent this?</p>
  
  <p>Tag removal is not what I want because if there is no match the tag should be added so I can drop the message.</p>