# Add\_tag and add\_field not working

**URL:** <https://discuss.elastic.co/t/add-tag-and-add-field-not-working/70238>\
**Category:** Logstash\
**Created:** [December 29, 2016, 10:26pm UTC](https://discuss.elastic.co/t/add-tag-and-add-field-not-working/70238 "2016-12-29T22:26:02Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mushi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mushi/32/14207_2.png) [@mushi](https://discuss.elastic.co/u/mushi)\
**Post date:** [December 29, 2016, 10:26pm UTC](https://discuss.elastic.co/t/add-tag-and-add-field-not-working/70238/1 "2016-12-29T22:26:02Z")

</div>

I'm using add\_tag and add\_field and I don't see any of the fields or tags in the resulting message.

in my conf:

```
filter {
  grok {
    match => {
      "message" => "%{SYSLOG5424LINE}"
      add_tag => ["boo"]
    }
  }
}
filter {
  dns {
    reverse => ["host", "hostname"]
    action => "replace"
    add_field => { "foo" => "boo" }
    add_tag => ["dns"]
  }
...

```

the output messages have `"tags":[]`. All the messages successfully pass through the syslog filter. Not sure about the DNS one, since it may be using cashed entries, but each message does have the dns result. The server is restarted and picked up the config file, so I don't know what's going on.

Using logstash 5.1.1 from rpm

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 26, 2017, 10:26pm UTC](https://discuss.elastic.co/t/add-tag-and-add-field-not-working/70238/2 "2017-01-26T22:26:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.