title: grok multiple messages and process them with different tags
body: <p>I want to make a filter in Logstash(version 2.4) with different matches in the same grok.
  I would like to add different tags depending on the match. 
  Basically, I receive three different message pattern:
  "##MAGIC##%message"
  "##REAL##%message"
  "%message"
  I am trying to do is:</p>
  
  <pre><code> grok {
   match =&gt; {"message" =&gt; "##MAGIC##%{GREEDYDATA:magic_message}"}
   match =&gt; {"message" =&gt; "##REAL##%{GREEDYDATA:real_message}"}
   match =&gt; {"message" =&gt; "%{GREEDYDATA:basic_message}"}
   if [magic_message]{
      overwrite =&gt; [ "message"]  
      add_tag =&gt; ["Magic"]
   } else if [real_message]{
      overwrite =&gt; [ "message"]  
      add_tag =&gt; ["Real"]
   }else{
     overwrite =&gt; [ "message"]  
      add_tag =&gt; ["Basic"]
   }
  </code></pre>
  
  <p>But, I got this compile fails:</p>
  
  <pre><code>    The given configuration is invalid. Reason: Expected one of #, =&gt; at line 34, column 9 (byte 900) after filter {
    grok {
       match =&gt; {"message" =&gt; "##MAGIC##%{GREEDYDATA:magic_message}"}
       match =&gt; {"message" =&gt; "##REAL##%{GREEDYDATA:real_message}"}
       match =&gt; {"message" =&gt; "%{GREEDYDATA:basic_message}"}
       if  {:level=&gt;:fatal}
  </code></pre>