Multiple Grok filters with Logstash 6 for a single logfile?

Elastic Stack Logstash
3

@magnusbaeck: If I understand you correctly, I could achieve my goal by doing partial Grok matches, correct?

grok {
  match => { "message" => "%{SYSLOGBASE}%{SPACE}%{GREEDYDATA:log_message}" }
}
if "_grokparsefailure" not in [tags] {
  #
  # Add program label tag
  if [program] {
    mutate { add_tag => [ "%{program}" ] }
  }
  #
  # SSH server
  if [program] == "sshd" {
    #
    # SSH server starts listening for incoming connections
    if [log_message] =~ "Server·listening·on" {
      grok {
        match => { log_message => "Server listening on %{IPORHOST:address} port %{POSINT:port}." }
        add_tag => [ "%{program}_server", "%{program}_server_start" ]
      }
    }
    #
    # SSH server receives a POSIX signal
    if [log_message] =~ "Received signal" {
      grok {
        match => { log_message => "Received signal %{NONNEGINT:posix_signal}; %{GREEDYDATA:action}." }
        add_tag => [ "%{program}_server" ]
      }
      if [action] == "terminating" {
        mutate { add_tag => [ "%{program}_server_stop" ] }
      }
    }
  }
}