Would this be via an additional condition within the filter or a separate filter file (I didn't think multiple filter files were supported).
You need two separate grok filters. They could be in the same configuration file or in different files. If you choose to put them in separate files just keep in mind that configuration files are read in alphabetical order and you obviously want the grok filter that creates the syslog_message field to run before the grok filter that attempts to parse the same field.