title: Grok match json field and value
body: <p>I'm using koajs with bunyan to save error logs to my server then I use filebeat to have them shipped to my logstash application.</p>
  
  <p>My error logs are being forwarded correctly however I would now like to create a filter which will add a tag to specific logs.</p>
  
  <pre><code>{"name":"myapp","hostname":"sensu-node-dev","pid":227,"level":50,"err":{"message":"Cannot find module 'lol'","name":"Error","stack":"Error: Cannot find module 'lol'\n    at Function.Module._resolveFilename (module.js:339:15)\n    at Function.Module._load (module.js:290:25)\n    at Module.require (module.js:367:17)\n    at require (internal/module.js:16:19)\n    at Object.&lt;anonymous&gt; (/srv/www/dev.site/app.js:27:6)\n    at next (native)\n    at Object.&lt;anonymous&gt; (/srv/www/dev.site/node_modules/koa-compose/index.js:29:5)\n    at next (native)\n    at onFulfilled (/srv/www/dev.site/node_modules/co/index.js:65:19)\n    at /srv/www/dev.site/node_modules/co/index.js:54:5","code":"MODULE_NOT_FOUND"},"msg":"Cannot find module 'lol'","time":"2016-02-24T22:04:26.492Z","v":0}
  </code></pre>
  
  <p>Now the interesting part in that specific log is <code>"err":{...}</code> and the <code>"name":"Error"</code> bits. For simplicity reasons I would just like to create a filter which detects <code>"name":"Error"</code> in the log (if it exists) and then apply a tag <code>add_tag =&gt; ["error"]</code> to the log.</p>
  
  <p>Here is my <code>/etc/logstash/conf.d/logstash.conf</code> file:</p>
  
  <pre><code>input {
    beats {
     port =&gt; 5044
     type =&gt; "logs"
    }
  }
  filter {
    grok { 
      type =&gt; "log"
      pattern =&gt; "???" // &lt;--- have no idea what to do here
      add_tag =&gt; ["error"]
    }
  }
  output {
    elasticsearch {
      hosts =&gt; "localhost:9200"
      sniffing =&gt; true
      manage_template =&gt; false
      index =&gt; "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
      document_type =&gt; "%{[@metadata][type]}"
    }
    http {
      http_method =&gt; "post"
      url =&gt; "&lt;MY_URL&gt;"
      format =&gt; "message"
      message =&gt; "{"text":"dis is workinz, you has error"}"
      tags =&gt; ["error"]
    }
  }
  </code></pre>
  
  <p>I tried the following:</p>
  
  <pre><code>pattern =&gt; ""name":"Error""
  </code></pre>
  
  <p>But got the following error:</p>
  
  <pre><code>Error: Expected one of #, {, } at line 9, column 31 (byte 107) after filter {
    grok {
      match =&gt; { "message" =&gt; ""
  You may be interested in the '--configtest' flag which you can
  use to validate logstash's configuration before you choose
  to restart a running system.
  </code></pre>
  
  <p>There is no simple example of this specific  type of matching anywhere.</p>
  
  <p>Bonus: Also how does one escape in logstash, I couldn't find anything on the subject?</p>