Any idea?

I test with that, and it doesn't work , did I do a mistake ?

filter {
if "disconnect" in [tags] {
mutate {
gsub => [
"test", " host ", "."
]
}

PS: My tag works