Grok add_field creates two values

I'm using logstash 2.1, and I have the following filter:

if ("sha1_hash" in [hash_field]) {
    grok {
        patterns_dir => ["/opt/logstash/patterns"]
        match => {"sha1_hash: %{SHA1:sha1}"}
        add_field => {"sha1" => "%{sha1}"}

The grok match works, but the add_field has a problem, it adds the value %{sha1} twice. Why is this happening and how can I solve this?


The match option already adds a sha1 field. The subsequent add_field adds the same field again, resulting in sha1 being an array with two identical values. Just drop the add_field line.