Grok add_field creates two values

Elastic Stack Logstash
1

Hi,
I'm using logstash 2.1, and I have the following filter:

if ("sha1_hash" in [hash_field]) {
    grok {
        patterns_dir => ["/opt/logstash/patterns"]
        match => {"sha1_hash: %{SHA1:sha1}"}
        add_field => {"sha1" => "%{sha1}"}
    }
}

The grok match works, but the add_field has a problem, it adds the value %{sha1} twice. Why is this happening and how can I solve this?

Thanks.

2

The match option already adds a sha1 field. The subsequent add_field adds the same field again, resulting in sha1 being an array with two identical values. Just drop the add_field line.