Grok filters stop evaluating expressions when they get a match, so if the COMBINEDAPACHELOG expression matches the other one won't be tried at all. Secondly, if the file path is stored in the source field you obviously need to tell the grok filter to match that field and not message.