filter {
  if "Traceback" in [message] {
    mutate {
      add_tag => ["traceback"]
      remove_tag => ["_grokparsefailure"]
    }
  }
}