title: File input add_field not adding field to every row
body: <p>I am parsing several logfiles of different load balanced serverclusters with my logstash config and would like to add a field "log_origin" to each file's entries for the later easy filtering. </p>
  
  <p>Here's my input->file config in a simple example:</p>
  
  <pre><code>input {
    file {
      type =&gt; "node1"
      path =&gt; "C:/Development/node1/log/*"
      add_field =&gt; [ "log_origin", "live_logs" ]
    }
    file {
      type =&gt; "node2"
      path =&gt; "C:/Development/node2/log/*"
      add_field =&gt; [ "log_origin", "live_logs" ]
    }
    file {
      type =&gt; "node3"
      path =&gt; "C:/Development/node1/log/*"
      add_field =&gt; [ "log_origin", "live_logs" ]
    }
    file {
      type =&gt; "node4"
      path =&gt; "C:/Development/node1/log/*"
      add_field =&gt; [ "log_origin", "live_logs" ]
    }
  }
  
  filter {
      grok {
          match =&gt; [
              "message","%{DATESTAMP:log_timestamp}%{SPACE}\[%{DATA:class}\]%{SPACE}%{LOGLEVEL:loglevel}%{SPACE}%{GREEDYDATA:log_message}"
          ]
      }
  
      date { 
          match =&gt; [ "log_timestamp",  "dd.MM.YY HH:mm:ss", "ISO8601" ]
          target =&gt; "@timestamp"
      }
  
      mutate {
          lowercase =&gt; ["loglevel"]
          strip     =&gt; ["loglevel"]
      }
  
      if "_grokparsefailure" in [tags] {
          multiline {
              pattern   =&gt; ".*"
              what      =&gt; "previous"
          }
      }
  
      if[fields.log_origin] == "live_logs"{
          if [type] == "node1" {
              mutate { 
                  add_tag =&gt; "realsServerName1"
              }
          }
          if [type] == "node2" {
              mutate { 
                  add_tag =&gt; "realsServerName2"
              }
          }
          if [type] == "node3" {
              mutate { 
                  add_tag =&gt; "realsServerName3"
               }
          }
          if [type] == "node4" {
              mutate { 
                  add_tag =&gt; "realsServerName4"
              }
          }
      }
  }
  
  output {
    stdout { }
    elasticsearch { embedded =&gt; true }
  }
  </code></pre>
  
  <p>I would have expected logstash to add this field with the value given to every logentry it finds, but it doesn't. Maybe I am completely taking the wrong approach here?</p>
  
  <p>Edit: I am not able to retrieve the logs directly from the nodes, but have to copy them over to my "server". Otherwise i would be able to just use the filepath for distinguishing different clusters...</p>
  
  <p>Edit: It's working. I should have cleand my data in between. Old entries without the field added cluttered up my results.</p>