# Adding tags to logs

**URL:** <https://discuss.elastic.co/t/adding-tags-to-logs/94545>\
**Category:** Logstash\
**Created:** [July 25, 2017, 10:40pm UTC](https://discuss.elastic.co/t/adding-tags-to-logs/94545 "2017-07-25T22:40:47Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![ashvita](https://avatars.discourse-cdn.com/v4/letter/a/ee59a6/32.png) [@ashvita](https://discuss.elastic.co/u/ashvita)\
**Post date:** [July 25, 2017, 10:40pm UTC](https://discuss.elastic.co/t/adding-tags-to-logs/94545/1 "2017-07-25T22:40:47Z")

</div>

Hi,  
I want to add tags to my incoming logs. Below is the snippet of the log-  
10.100.213.171 Jul 25 22:02:42 x86-hw [user.info](http://user.info) Cmog: 4884:UpgradeActor D {[4 04:01:52] DbUtil.cpp:805}[-4052732736]::[StartIcsClient]::domain=0 server=GRdbSvr

I want to tag this snippet of log as Upgrade. How should I go ahead?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 26, 2017, 7:03am UTC](https://discuss.elastic.co/t/adding-tags-to-logs/94545/2 "2017-07-26T07:03:59Z")

</div>

What filters do you currently have?

---

<div class="post-metadata">

**Author:** ![ashvita](https://avatars.discourse-cdn.com/v4/letter/a/ee59a6/32.png) [@ashvita](https://discuss.elastic.co/u/ashvita)\
**Post date:** [July 27, 2017, 11:08pm UTC](https://discuss.elastic.co/t/adding-tags-to-logs/94545/3 "2017-07-27T23:08:31Z")

</div>

filter{  
grok{  
match =\> ['message', '%{IP:NodeIP} %{SYSLOGTIMESTAMP:@timestamp} %{DATA:Arch} %{DATA:Server}: %{DATA:Junk} %{WORD:Info} %{GREEDYDATA:log\_message}']  
break\_on\_match =\> false  
}

```
    grok {
            match => ['message', '...ZTR..']
            add_tag => 'ztr'
            break_on_match => false

```

}

```
    grok {
            match => ['message', '..Workaround..']
            add_tag => 'workaround'
            break_on_match => true
    }

```

}

---

<div class="post-metadata">

**Author:** ![ashvita](https://avatars.discourse-cdn.com/v4/letter/a/ee59a6/32.png) [@ashvita](https://discuss.elastic.co/u/ashvita)\
**Post date:** [July 31, 2017, 7:54pm UTC](https://discuss.elastic.co/t/adding-tags-to-logs/94545/4 "2017-07-31T19:54:03Z")

</div>

Can someone please help me out on this? I am stuck.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 2, 2017, 6:51pm UTC](https://discuss.elastic.co/t/adding-tags-to-logs/94545/5 "2017-08-02T18:51:22Z")

</div>

Please show an example event that isn't correctly processed. Use a `stdout { codec => rubydebug }` output so we can see a raw dump of the event after Logstash has processed it.

---

<div class="post-metadata">

**Author:** ![ashvita](https://avatars.discourse-cdn.com/v4/letter/a/ee59a6/32.png) [@ashvita](https://discuss.elastic.co/u/ashvita)\
**Post date:** [August 3, 2017, 6:30pm UTC](https://discuss.elastic.co/t/adding-tags-to-logs/94545/6 "2017-08-03T18:30:56Z")

</div>

It gives me \_grokparsefailure tag if there is no matching word. I want to leave it untagged if nothing matches. What should I do?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 3, 2017, 6:49pm UTC](https://discuss.elastic.co/t/adding-tags-to-logs/94545/7 "2017-08-03T18:49:04Z")

</div>

Set the `tag_on_failure` option to an empty array.

---

<div class="post-metadata">

**Author:** ![ashvita](https://avatars.discourse-cdn.com/v4/letter/a/ee59a6/32.png) [@ashvita](https://discuss.elastic.co/u/ashvita)\
**Post date:** [August 3, 2017, 8:30pm UTC](https://discuss.elastic.co/t/adding-tags-to-logs/94545/8 "2017-08-03T20:30:55Z")

</div>

Awesome! Thank you so much!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 31, 2017, 8:31pm UTC](https://discuss.elastic.co/t/adding-tags-to-logs/94545/9 "2017-08-31T20:31:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.