Copy part of a field into new field

[Badger]

Because the syntax is grok { match => { "field" => "pattern" }} not grok { match => [ "field" , "pattern" ]}