gistfile1.txt

# Add src_ip if not already found
filter {
        if [type] == "syslog" {
                if [src_ip] == "" {
                        mutate {
                                add_field => [ "src_ip", "%{syslog_hostname}" ]
                        }
                        dns {
                                resolve => [ "src_ip" ]
                                action => "replace"
                        }
                }
        }
}

more like:

if ![src_ip] {