diff --git a/pipeline/filters/rewrite-tag.md b/pipeline/filters/rewrite-tag.md
index 03944ebe8..6f81a1cac 100644
--- a/pipeline/filters/rewrite-tag.md
+++ b/pipeline/filters/rewrite-tag.md
@@ -176,6 +176,54 @@ $ fluent-bit -c example.conf
 ...
 [0] from.test_tag.new.fluent.bit.out: [1580436933.000050569, {"tool"=>"fluent", "sub"=>{"s1"=>{"s2"=>"bit"}}}]
 ```
+## Configuration example with multiple rules 
+In cases using multiple rules, the rules are passed through in order until one matches. With `AND_COMBINE` using the value `true` as optional fifth  component, the rule is combined with the following rule like an 'and' combination. If the first and following rule match, the message is retagged with the tag in the last matched rule.
+
+An `AND_COMBINE` in the last rule is ignored. 
+```text
+[SERVICE]
+    Flush     5
+    Log_Level info
+
+[INPUT]
+    Name tail
+    Tag  tail
+    Path /var/tmp/loginput.txt
+
+[FILTER]
+    Name          rewrite_tag
+    Match         tail
+    Rule          $log ^(1)$      newtag_or    false
+    Rule          $log ^(.*and)$  newtag_and_1 false true
+    Rule          $log ^(1.*)$    newtag_and_2 false
+    Rule          $log ^(42)$     newtag_or    false
+    Rule          $log ^(9)$      newtag_and_3 false true
+
+[OUTPUT]
+    Name  stdout
+    Match *
+```
+Use the input file `/var/tmp/loginput.txt`:
+```text
+1
+2
+3
+9
+10and
+10
+42
+```
+
+The log messages will be rewritten:
+```
+fluent-bit_1  | [0] tail: [1596050753.241336500, {"log"=>"2"}]
+fluent-bit_1  | [1] tail: [1596050753.241356700, {"log"=>"3"}]
+fluent-bit_1  | [2] tail: [1596050753.241410100, {"log"=>"10"}]
+fluent-bit_1  | [0] newtag_or: [1596050753.237370100, {"log"=>"1"}]
+fluent-bit_1  | [1] newtag_or: [1596050753.241427200, {"log"=>"42"}]
+fluent-bit_1  | [0] newtag_and_3: [1596050753.241374500, {"log"=>"9"}]
+fluent-bit_1  | [0] newtag_and_2: [1596050753.241392800, {"log"=>"10and"}]
+```
 
 ## Monitoring