Something like this?
input {
generator {
lines => ['message1']
count => 1
add_field => { "[@metadata][key]" => "test" }
}
}
filter {
if [@metadata][key] == "test" {
mutate {
add_tag => ["found"]
}
}
}
output {
stdout { codec => rubydebug { metadata => true }}
}