Check whether a tag exists in Logstash

Use "tagname" in [tags] to check for a tag, and "tagname" not in [tags] to check that it is absent. With the normal array representation of tags, this tests an exact element match.

Route parsing failures

Grok's default failure tag includes a leading underscore:

filter {
  if "_grokparsefailure" in [tags] {
    mutate { add_tag => ["needs_parser_review"] }
  }
}

Testing for grokparsefailure without the underscore does not match _grokparsefailure. If you configure a custom tag_on_failure, test that name instead.

A missing tag can also drive a deliberate drop policy:

filter {
  if "production" not in [tags] {
    drop { }
  }
}

This removes events without that tag, including events whose tags field is absent. Confirm that this is your intended retention policy before enabling it.

Add, remove, and combine tags

filter {
  mutate { add_tag => ["processed"] }

  if "date_repaired" in [tags] {
    mutate { remove_tag => ["_dateparsefailure"] }
  }

  if ("error" in [tags]) and ("critical" in [tags]) {
    mutate { add_tag => ["page_on_call"] }
  }
}

Remove a failure marker after a successful repair, rather than hiding errors indiscriminately. Custom tags such as to_es can then select an output with if "to_es" in [tags].

Check the field type

[tags] == "urgent" compares the entire field with a string, so it is not the membership test for an array. Conversely, in against a string performs substring matching; malformed input such as "not-urgent" can therefore produce an unexpected match. Inspect the event and preserve tags as an array.

Special characters inside a quoted tag are matched literally for array membership, subject to normal string escaping. Beats may add codec-related tags such as beats_input_codec_plain_applied, but these depend on plugin settings and versions. Build routing around tags your pipeline deliberately controls.

References

• Elastic: event dependent configuration
• Elastic: filters grok
• Elastic: filters mutate