Errors are saved in an array named tags. For example Grok will add _grokparsefailure to that tag when something happens. Then you can do your error handling from that.
if "_grokparsefailure" in [tags] {
# do something
}
_grokparsefailure documentation
_mutate_error
The tag_on_failure option is what you are looking for and you can set it to what you want or use the defaults.