Overwrite message field issue in grok match

Elastic Stack Logstash
2

Well you have told it to overwrite the [message] field, so the "10.20.30.11" overwrites the "31438214312" value. You could use

    grok { match => { "message" => "(?<[@metadata][message]>(\d{9,12})|(\d{9,12}))%{GREEDYDATA}%{IPV4:[@metadata][message]}" } }
    mutate { rename => { "[@metadata][message]" => "message" } }

Note that the leading %{DATA} and trailing %{GREEDYDATA} in your pattern do nothing, and you can remove them to simplify the pattern.