Hi @Immac, welcome to the Elastic community forums!
If you simply want to distinguish logs collected by Filebeat modules vs. logs collected by a custom input, you won't need to add any special tags. This is because all log events generated by Filebeat modules will contain an event.module field whereas the log events generated by your custom input won't (unless you do some explicit extra configuration to add such a field, of course).
Given this, you can simply test for the existence of this event.module field in your Logstash pipeline like so:
if [event][module] {
# process log events generated by modules
} else {
# process log events generated by custom input
}
Hope that helps,
Shaunak