Is there a way to tag for different grok matches?

[magnusbaeck (Magnus Bäck)]

Wrap all but the first grok filter in a conditional so that the subsequent ones are only tried if there hasn't been a match earlier.

grok {
  ...
}
if "_grokparsefailure" in [tags] {
  grok {
    ...
    remove_tag => ["_grokparsefailure"]
  }
}