Grok filter if condition issue

[magnusbaeck (Magnus Bäck)]

This isn't a grok question, it's a general filter question. This is probably what you're looking for:

filter {
  ...
  if "method" in [tags] {
    mutate {
      add_tag => ["newtag", "manualtag"]
    }
  }
}