How can I find some designated value after using split

Elastic Stack Logstash
3

Hi @Badger,
thanks to your answer, I will try it.
so

    fliter {
      if "SYN" in [flow][tcp_flags] {
        mutate {
          add_field => {
            "has_syn" => "true"
          }
        }
      }
    }

can works as I expected?