Grok filter - check field existence - logstash-grok

Question

I have a log message with this structure:
"message" => "{
"#timestamp":"201856T12:54:33.347+02:00",
"thread":"main",
"logger_name":"org.elasticsearch.bootstrap",
"level":"WARN",
"message":"JNA not found. native methods will be disabled.",
"stack_trace": "java.lang.ClassNotFoundException: ...
}
As you can see, inside the message there is a stack_trace field, but the control
if [message][stack_trace] {
mutate { add_tag => ["EXCEPTION"] }
}
doesn't work
How can I check if "message" contains the "stack_trace" field?
Other infos:
the message is generated via logstash-logback-encoder, as follow:
<appender name="STASH" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
<destination>localhost:5000</destination>
<encoder class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
<providers>
<timestamp>
<timeZone>Europe/Berlin</timeZone>
</timestamp>
<callerData>
<classFieldName>classname</classFieldName>
<methodFieldName>method</methodFieldName>
<fileFieldName>file</fileFieldName>
<lineFieldName>line</lineFieldName>
</callerData>
<threadName>
<fieldName>thread</fieldName>
</threadName>
<loggerName />
<logLevel />
<message />
<stackTrace />
</providers>
</encoder>
</appender>
This is the content of logstash input pipeline:
input {
tcp {
port => 5000
}
}
filter {
grok {
match => { "message" => "LAT: %{NUMBER:LAT:float}, LON: %{NUMBER:LON:float}"}
match => { "message" => "file %{WORD:TIPOFILE} elaborato" }
match => { "message" => "Pubblicazione file %{WORD:PUB_FILENAME} sulla coda %{WORD:DEST_QUEUE} terminata" }
}
mutate {
rename => { "TIPOFILE" => "[filename]" }
rename => { "LAT" => "[location][latitude]" }
rename => { "LON" => "[location][longitude]" }
rename => { "DEST_QUEUE" => "[destQueue]" }
rename => { "PUB_FILENAME" => "[nomeFilePubbl]" }
}
}
output {
stdout {
codec => rubydebug
}
elasticsearch {
hosts => "elasticsearch:9200"
}
}