filter_rewrite_tag: add and-combination for rules

pipeline/filters/rewrite-tag.md

@@ -176,6 +176,54 @@
 ...
 [0] from.test_tag.new.fluent.bit.out: [1580436933.000050569, {"tool"=>"fluent", "sub"=>{"s1"=>{"s2"=>"bit"}}}]
 ```
+## Configuration example with multiple rules 
+In cases using multiple rules, the rules are passed through in order until one matches. With `AND_COMBINE` using the value `true` as optional fifth  component, the rule is combined with the following rule like an 'and' combination. I f the first and following rule match, the message is retagged with the tag in the last matched rule.
+
+An `AND_COMBINE` in the last rule is ignored. 
+```text
+[SERVICE]
+    Flush     5
+    Log_Level info
+
+[INPUT]
+    Name tail
+    Tag  tail
+    Path /var/tmp/loginput.txt
+
+[FILTER]
+    Name          rewrite_tag
+    Match         tail
+    Rule          $log ^(1)$      newtag_or    false
+    Rule          $log ^(.*and)$  newtag_and_1 false true
+    Rule          $log ^(1.*)$    newtag_and_2 false
+    Rule          $log ^(42)$     newtag_or    false
+    Rule          $log ^(9)$      newtag_and_3 false true
+
+[OUTPUT]
+    Name  stdout
+    Match *
+```
+inputfile /var/tmp/loginput.txt
+```text
+1
+2
+3
+9
+10and
+10
+42
+```
+
+The log messages will be rewritten:
+```
+fluent-bit_1  | [0] tail: [1596050753.241336500, {"log"=>"2"}]
+fluent-bit_1  | [1] tail: [1596050753.241356700, {"log"=>"3"}]
+fluent-bit_1  | [2] tail: [1596050753.241410100, {"log"=>"10"}]
+fluent-bit_1  | [0] newtag_or: [1596050753.237370100, {"log"=>"1"}]
+fluent-bit_1  | [1] newtag_or: [1596050753.241427200, {"log"=>"42"}]
+fluent-bit_1  | [0] newtag_and_3: [1596050753.241374500, {"log"=>"9"}]
+fluent-bit_1  | [0] newtag_and_2: [1596050753.241392800, {"log"=>"10and"}]
+```
 
 ## Monitoring