When you use add_field like this it'll only trigger when the filter is successful, i.e. the grok filter (in this case) has matched.
If the grok filter fails it'll additionally tag the event with _grokparsefailure (unless configured otherwise with the tag_on_failure option).