You might be able to use the translate filter, which you can then conditionally check if the translate was successful (value is equal to new replaced value, added a field, added a tag, etc). Doing a lookup on each incoming message against a large dictionary will be a performance bottleneck.
https://www.elastic.co/guide/en/logstash/current/plugins-filters-translate.html