title: Logstash - How to use multiple geoip filter in one message
body: <p>I'd like to include two geoip filter to be applied to one logstash message - let's say: A firewall message with a dst field (firewall location) and a src field (access source).</p>
  
  <p>An log entry may look like this:</p>
  
  <pre><code>&lt;190&gt;2015 Mar 23 02:21:30 fw1 &lt;50000&gt; Dropped Inbound packet (Stateless ICMP) Src:87.245.196.38 Dst:154.54.27.169 Type:11 Code:0 IPP:1 Rule:-1 Interface:WAN (Internet)
  </code></pre>
  
  <p>The filters are defined in the logstash.conf as follows:</p>
  
  <pre><code>if [message] =~ "packet" {
          grok {
              match =&gt; [ 
                  "message", "&lt;%{POSINT:syslog_pri}&gt;%{YEAR} %{SYSLOGTIMESTAMP:syslog_timestamp} %{DATA:device} &lt;%{POSINT:status}&gt; %{WORD:activity} %{DATA:inout} \(%{DATA:msg}\) Src:%{IPV4:src} SPort:%{INT:sport} Dst:%{IPV4:dst} DPort:%{INT:dport} IPP:%{INT:ipp} Rule:%{INT:rule} Interface:%{WORD:iface}",
                  "message", "&lt;%{POSINT:syslog_pri}&gt;%{YEAR} %{SYSLOGTIMESTAMP:syslog_timestamp} %{DATA:device} &lt;%{POSINT:status}&gt; %{WORD:activity} %{DATA:inout} \(%{DATA:msg}\) Src:%{IPV4:src} Dst:%{IPV4:dst} Type:%{POSINT:type} Code:%{INT:code} IPP:%{INT:ipp} Rule:%{INT:rule} Interface:%{WORD:iface}"
              ]
          }
          geoip { source =&gt; "src" }
          geoip { source =&gt; "dst" }
  }
  </code></pre>
  
  <p>The message gets parsed well (no _grokparsefailure), but only one geoip information (the last one "dst") is attached. </p>