Small enhancement by proof-reading grok doc + comments

Noticeable change:
- corrected the doc for tag_on_failure
- removing the type from the first example as it is optional in 1.2.x
- in the 2nd example, renamed the matched value "message" to "syslog_message" to keep the example simple without a need to explain field overwriting at this point.
- typos