title: Logstash create a new field based on existing field
body: <p>I have data coming from database queries using jdbc input plugin and result from queries contains <code>url</code> field from which I want to extract a few properties. </p>
  
  <p>Example urls:</p>
  
  <blockquote>
    <ul>
    <li>/incident.do?sys_id=0dc18b246faa17007a64cbe64f3ee4e1&amp;sysparm_view</li>
    <li>/navpage_form_default.do</li>
    <li>/u_pm_prov_project_list.do?sysparm_userpref_module=fa547ce26f661</li>
    <li>JOB: email read events process</li>
    <li>JOB: System - reduce resources</li>
    </ul>
  </blockquote>
  
  <p>I added regex patterns in grok patterns file:</p>
  
  <pre><code>webpage_category .*
  job_type .*
  </code></pre>
  
  <p>I have two types of url so I used if in filter block to distinguish between them </p>
  
  <p>Config I tried so far:</p>
  
  <pre><code>filter {
         if [url] =~ /JOB: .*/ {
                 grok {
                      patterns_dir =&gt; ["/etc/logstash/patterns"]
                      match =&gt; {
                               "url" =&gt; "JOB: %{job_type:job_type}"
                      }
                 }
          } else
          if [url] =~ /\/.*\.do\?.*/ {
                  grok {
                       patterns_dir =&gt; ["/etc/logstash/patterns"]
                       match =&gt; {
                                "url" =&gt; "/{webpage_category:webpage_category}\.do\?.*"
                       }
                   }
           }
  }
  </code></pre>
  
  <p>Creation of a new field for urls starting with <code>JOB:</code> works properly but <code>webpage_category</code> is not working at all. Is it because regex can not be used inside of match?</p>