# Logstash Handling Filter Errors

**URL:** <https://discuss.elastic.co/t/logstash-handling-filter-errors/287309>\
**Category:** Logstash\
**Created:** [October 21, 2021, 11:21am UTC](https://discuss.elastic.co/t/logstash-handling-filter-errors/287309 "2021-10-21T11:21:35Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [October 21, 2021, 11:29am UTC](https://discuss.elastic.co/t/logstash-handling-filter-errors/287309/2 "2021-10-21T11:29:09Z")

</div>

Errors are saved in an array named `tags`. For example Grok will add `_grokparsefailure` to that tag when something happens. Then you can do your error handling from that.

```auto
if "_grokparsefailure" in [tags] {
# do something
}

```

[\_grokparsefailure documentation](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html#plugins-filters-grok-tag_on_failure)  
[\_mutate\_error](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-tag_on_failure)

The `tag_on_failure` option is what you are looking for and you can set it to what you want or use the defaults.

---

_[View the full topic](https://discuss.elastic.co/t/logstash-handling-filter-errors/287309)._