Implement exclusive grok

In a scenario like the below:

```
grok{
                        match => { "message" => ["%{SSH_AUTH_1}","%{SSH_AUTH_2}"] }
                        patterns_dir => "/opt/elk/PRODSEC/logstash/config/patterns"
                        add_tag => [ "auth_success" ]
                    }

                grok{
                        match => { "message" => ["%{SSH_AUTH_3}","%{SSH_AUTH_4}"] }
                        patterns_dir => "/opt/elk/PRODSEC/logstash/config/patterns"
                        add_tag => [ "auth_failure" ]
                    }

                if "auth_success" in [tags] or "auth_failure" in [tags]{
                    mutate {
                                remove_tag => [ "_grokparsefailure" ]
                            }
                }

```

the goal is to run an event through a list of grok filters and tag(categorize) the event.
Today this approach suffers from the fact that there is no elegant/user friendly way to exit the grok filter(s) as soon as one of the pattern has matched. All the grok filters will need to be executed regardless of the fact that a match had already occurred. This causes the "_grokparsefailure" to inevitably be added to the event even though a match was performed.

it'd be great to explore possibilities for making this less painful , e.g. through a exclusive-grok (just to give the idea)

```
exclusive-grok{ #on first matching grock block, complete grock block execution
then jump to end of exclusive-grok block
grok{
                        match => { "message" => ["%{SSH_AUTH_1}","%{SSH_AUTH_2}"] }
                        patterns_dir => "/opt/elk/PRODSEC/logstash/config/patterns"
                        add_tag => [ "auth_success" ]
                    }

                grok{
                        match => { "message" => ["%{SSH_AUTH_3}","%{SSH_AUTH_4}"] }
                        patterns_dir => "/opt/elk/PRODSEC/logstash/config/patterns"
                        add_tag => [ "auth_failure" ]
                    }
}
```