Why not set the logtype field already on the input side? Why do you need to use grok to figure out what kind of a log it is?
if [tag] == "apache" {
Do you really have a field named tag? Or did you mean "apache" in [tags]?
I suggest you disable the _grokparsefailure tag (using the tag_on_failure option) and change
if "_grokparsefailure" in [tags] {
into
if not [logtype] {
so that you delete events that haven't had the logtype field set, indicating that none of the grok filters matched.
But really, instead of dropping those events you should save them somewhere. How would you otherwise know if your grok filters are incorrectly failing to match some legitimate input events?