Got this working and just wanted to paste the syntax that does what I wanted it to do
if ! [@metadata][log_prefix] {
alter {
add_field => {
"[@metadata][log_prefix]" => "fix"
}
}
}
No double quote after if !
Very happy with the outcome. Works exactly as I had hoped.