Troubleshoot logstash grok logs

logstash

#This config does not work, it never enters the if [tag] == derp block

input {
  stdin {}
}
filter {
  grok {
    #match   => [ "message", ".*" ]
    match   => [ "message", "%{GREEDYDATA}" ]
    add_tag => [ "derp" ]
  }
}
output {

  # Why does this if statement not work? 
  if [tag] == "derp" {
    stdout {}
    email {
      to      => "spuder@foo.com"
      from    => "logstash@foo.com"
      subject => "herp"
      body    => "herp a derp %{message}"
      via     => "sendmail"
    }
  }
  
  # IF I change tag to type => foo, then logstash works properly, it seems that you can perform conditionals on tags. 
}

because tags are an array, you need to use the following (thanks coolacid in irc)

if "derp" in [tags]