As others say you can add a tag field with a pipeline (set_fields) or you can also use an extractor (replace with regular expression).
Personally I tag my events (atuhentication, network…) thanks to extractors.
However Graylog does not support multivalues fields so it’s a bit tricky if you need to add multiple tags to one event.