title: Logstash not conditionally filtering based on Filebeat's fields
body: <p>I am trying to feed Zabbix log data into an ELK stack to do some timing correlations. However, I'm not getting the filter specified by my Logstash centralized server configuration that I would if it was acting as an agent. I'm using Filebeat to send the log entries to Logstash for processing. However, the <code>fields.tags</code> line is not being acknowledged by Logstash, but is visible in Elasticsearch/Kibana. Here are my configs. </p>
  
  <pre><code>filebeat: 
    prospectors: 
      - 
        paths:
          - /var/log/zabbix/zabbix_proxy.log
        input_type: log
        fields: 
          tags: ["zabbix", "zabbix-proxy"]
    registery_file: /var/lib/filebeat/registry
  output: 
    logstash: 
      hosts: ["elkls.com:5044"]
  logging: 
    files: 
      rotateeverybytes: 12345656
  </code></pre>
  
  <p>and then my Logstash configuration file</p>
  
  <pre><code>input { 
    beats { 
      port =&gt; 5044
    }
  }
  filter { 
    if "zabbix" in [fields.tags] {
      grok { 
        match =&gt; { 
          "message" =&gt; {
            "filter stuff here"
          }
        }
      }
    }
  }
  output {
    elasticsearch { 
      hosts =&gt; [ "elkhost.com:9200"]
    }
  }
  </code></pre>
  
  <p>Logstash isn't acting upon the <code>fields.tags</code> line, and filtering/cutting up the log lines being passed to it from Filebeat. Am I accessing those variables correctly? I do something similar with other files, but only when Logstash is acting as an agent, and reading directly from a file. </p>