filter_rewrite_tag: add and-combination for rules (#349)

* filter_rewrite_tag: add and-combination for rules

description for and-combination for rewrite_tag filter rules
PR: fluent/fluent-bit#2399

Signed-off-by: Michael Voelker <novecento@gmx.de>

* Apply suggestions from code review

Signed-off-by: Lynette  Miles <6818907+esmerel@users.noreply.github.com>

* Apply suggestions from code review

Signed-off-by: Lynette  Miles <6818907+esmerel@users.noreply.github.com>

---------

Signed-off-by: Michael Voelker <novecento@gmx.de>
Signed-off-by: Lynette  Miles <6818907+esmerel@users.noreply.github.com>
Co-authored-by: Lynette  Miles <6818907+esmerel@users.noreply.github.com>

Author: novegit

pipeline/filters/rewrite-tag.md

@@ -176,6 +176,54 @@ $ fluent-bit -c example.conf
 ...
 [0] from.test_tag.new.fluent.bit.out: [1580436933.000050569, {"tool"=>"fluent", "sub"=>{"s1"=>{"s2"=>"bit"}}}]
 ```
+## Configuration example with multiple rules 
+In cases using multiple rules, the rules are passed through in order until one matches. With `AND_COMBINE` using the value `true` as optional fifth  component, the rule is combined with the following rule like an 'and' combination. If the first and following rule match, the message is retagged with the tag in the last matched rule.
+
+An `AND_COMBINE` in the last rule is ignored. 
+```text
+[SERVICE]
+    Flush     5
+    Log_Level info
+
+[INPUT]
+    Name tail
+    Tag  tail
+    Path /var/tmp/loginput.txt
+
+[FILTER]
+    Name          rewrite_tag
+    Match         tail
+    Rule          $log ^(1)$      newtag_or    false
+    Rule          $log ^(.*and)$  newtag_and_1 false true
+    Rule          $log ^(1.*)$    newtag_and_2 false
+    Rule          $log ^(42)$     newtag_or    false
+    Rule          $log ^(9)$      newtag_and_3 false true
+
+[OUTPUT]
+    Name  stdout
+    Match *
+```
+Use the input file `/var/tmp/loginput.txt`:
+```text
+1
+2
+3
+9
+10and
+10
+42
+```
+
+The log messages will be rewritten:
+```
+fluent-bit_1  | [0] tail: [1596050753.241336500, {"log"=>"2"}]
+fluent-bit_1  | [1] tail: [1596050753.241356700, {"log"=>"3"}]
+fluent-bit_1  | [2] tail: [1596050753.241410100, {"log"=>"10"}]
+fluent-bit_1  | [0] newtag_or: [1596050753.237370100, {"log"=>"1"}]
+fluent-bit_1  | [1] newtag_or: [1596050753.241427200, {"log"=>"42"}]
+fluent-bit_1  | [0] newtag_and_3: [1596050753.241374500, {"log"=>"9"}]
+fluent-bit_1  | [0] newtag_and_2: [1596050753.241392800, {"log"=>"10and"}]
+```
 
 ## Monitoring