Grab value from message field and add it to a new field

[warkolm (Mark Walkom)]

Maybe this will be better https://www.elastic.co/guide/en/logstash/current/advanced-pipeline.html#configuring-grok-filter