fix grok filter test to expect for not array values with add_field