The add_tag part is wrong.

http://logstash.net/docs/1.4.1/filters/mutate#add_tag

should be ```add_tag => ['ERROR']```
if you want tot add a field:
``` add_field => { 'level' => 'ERROR' } ```