# Add tag for only one beat

**URL:** <https://discuss.elastic.co/t/add-tag-for-only-one-beat/179512>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [May 3, 2019, 10:04am UTC](https://discuss.elastic.co/t/add-tag-for-only-one-beat/179512 "2019-05-03T10:04:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Robin020](https://avatars.discourse-cdn.com/v4/letter/r/71c47a/32.png) [@Robin020](https://discuss.elastic.co/u/Robin020)\
**Post date:** [May 3, 2019, 10:04am UTC](https://discuss.elastic.co/t/add-tag-for-only-one-beat/179512/1 "2019-05-03T10:04:51Z")

</div>

I am trying to add an tag for the logs of packetbeat before it sends to elasticsearch.

Packetbeat send his logs to logstash. In the logstash pipiline file i want to try to add an tag only for logs of packetbeat but I don't understand how because there is one input (pipeline) file for all beats on the same port.  
I don't know how to specify an tag only for one beat.

Hope someone can help me.

Kind regards,  
Robin

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [May 3, 2019, 1:04pm UTC](https://discuss.elastic.co/t/add-tag-for-only-one-beat/179512/2 "2019-05-03T13:04:36Z")

</div>

You can add tags directly in packetbeat configuration:

packetbeat.yml

```auto
# The tags of the shipper are included in their own field with each
# transaction published. Tags make it easy to group servers by different
# logical properties.
tags: ["service-X", "web-tier"]

```

This will add a `tags` field to each event with the specified tags.

---

<div class="post-metadata">

**Author:** ![Robin020](https://avatars.discourse-cdn.com/v4/letter/r/71c47a/32.png) [@Robin020](https://discuss.elastic.co/u/Robin020)\
**Post date:** [May 3, 2019, 1:09pm UTC](https://discuss.elastic.co/t/add-tag-for-only-one-beat/179512/3 "2019-05-03T13:09:18Z")

</div>

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 31, 2019, 1:09pm UTC](https://discuss.elastic.co/t/add-tag-for-only-one-beat/179512/4 "2019-05-31T13:09:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.