# Adding tags

**URL:** <https://discuss.elastic.co/t/adding-tags/126788>\
**Category:** Logstash\
**Created:** [April 4, 2018, 4:58pm UTC](https://discuss.elastic.co/t/adding-tags/126788 "2018-04-04T16:58:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Salma](https://avatars.discourse-cdn.com/v4/letter/s/fbc32d/32.png) [@Salma](https://discuss.elastic.co/u/Salma)\
**Post date:** [April 4, 2018, 4:58pm UTC](https://discuss.elastic.co/t/adding-tags/126788/1 "2018-04-04T16:58:51Z")

</div>

Hi,  
I'm trying to add some tags based on a given array.  
if the request was equal to one of the values that are on the tags, then I want Logstash to tag it as normal, else abnormal.

Following is my code, but unfortunately, it is tagging all data as abnormal

```
input { 
 file {
  path => "/*"
  start_position => "beginning"
  sincedb_path => "/dev/null"
  tags => ["/index.html", "/"]
  }
}

filter {
  grok { match => { "message" => '%{IPV4:clientip} %{NOTSPACE:ER} %{NOTSPACE:EO} \[%{HTTPDATE:timestamp}\] \"%{NOTSPACE:Method} %{DATA:request} HTTP/%{NUMBER:httpversion}\" %{NUMBER:HTTPStatus} %{NOTSPACE:ObjectSize} %{QS:referrer} %{QS:User_Agent}' } }
.
.
.
.

   if "request" in [tags] { mutate {add_tag => ["normal"] } } 
   else { mutate {add_tag => ["abnormal"] } }
 
  }
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 4, 2018, 5:12pm UTC](https://discuss.elastic.co/t/adding-tags/126788/2 "2018-04-04T17:12:13Z")

</div>

> [@Salma](#):
>
> if "request" in [tags]

If you want to test whether grok added a request field to the event then use this. It is not a tag.

```auto
if [request] { ... }

```

Or perhaps test for the \_grokparsefailure tag.

---

<div class="post-metadata">

**Author:** ![Salma](https://avatars.discourse-cdn.com/v4/letter/s/fbc32d/32.png) [@Salma](https://discuss.elastic.co/u/Salma)\
**Post date:** [April 4, 2018, 7:29pm UTC](https://discuss.elastic.co/t/adding-tags/126788/3 "2018-04-04T19:29:20Z")

</div>

**Problem solved** using _ruby_ filter

```
filter {
  grok { match => { "message" => '%{IPV4:clientip} %{NOTSPACE:ER} %{NOTSPACE:EO} \[%{HTTPDATE:timestamp}\] \"%{NOTSPACE:Method} %{DATA:request} HTTP/%{NUMBER:httpversion}\" %{NUMBER:HTTPStatus} %{NOTSPACE:ObjectSize} %{QS:referrer} %{QS:User_Agent}' } }
.
.
.
.

     mutate {add_field => { "activity" => "abnormal" } }
         
    ruby {
        code => 'ary=["/index.html", "/"]
        if ary.include?event.get("request".to_s)
          event.set("activity", "normal".to_s)
          end'
      }}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 2, 2018, 7:29pm UTC](https://discuss.elastic.co/t/adding-tags/126788/4 "2018-05-02T19:29:43Z")

</div>

Closed on May 2, 2018, 7:29pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.