logstash-metadata.conf

input {
  stdin { }
}

filter {

# initialize metadata field used as flag
mutate {
  add_field => { "[@metadata][foundtype]" => "" }
}

# try to match 'hello' looking messages
if "" == [@metadata][foundtype] {
  grok {
    match => { "message" => "hello %{GREEDYDATA:[@metadata][myname]}" }
    break_on_match => false
    add_field => { "[@metadata][foundtype]" => "hellotype" }
    add_tag => [ "didhello" ]
  }
}

# try to match 'bye' looking messages
if "" == [@metadata][foundtype] {
  grok {
    match => { "message" => "bye %{GREEDYDATA:[@metadata][myname]}" }
    break_on_match => false
    add_field => { "[@metadata][foundtype]" => "byetype" }
    add_tag => [ "didbye" ]
  }
}

#  add description based on flag
if !("" == [@metadata][foundtype]) {
  mutate {
    add_field => { "description" => "action performed by %{[@metadata][myname]}" }
  }
}else {
  mutate {
    add_field => { "description" => "this was not a hello or bye message type" }
  }
}


} # filter

output {
 stdout { codec => rubydebug }
}