Logstash @fields.anything usage example. Documentation is not very explicit in this topic.

logstash_grep_fields.rb

# I want to add tag => 'nagios' to every record where:
# @fields.severity == "PHP Fatal"

filter {
  # Does not work
  grep {     
    match   => [ "@fields.severity", "PHP Fatal" ]
    add_tag => [ "nagios" ]
    drop    => false
  }

  # Works, but is not really explicit
  grep {     
    match   => [ "severity", "PHP Fatal" ]
    add_tag => [ "nagios" ]
    drop    => false
  }

  # Works, but it's overkill - parses whole @message
  grep {     
    match   => [ "@message", "PHP Fatal" ]
    add_tag => [ "nagios" ]
    drop    => false
  }
}