I cant make work multi grok filter for a file type

[warkolm (Mark Walkom)]

Try this instead;

match => ["message", "%{CISCO_NAT_OUTGOING_DETAIL}, "%{CISCO_NAT_OUTGOING_TCP}" , "%{CISCO_NAT_OUTGOING_DETAIL}" ]

Or try using elseif's for the other two conditionals.