# Can I tag the events using Winlogbeat?

**URL:** <https://discuss.elastic.co/t/can-i-tag-the-events-using-winlogbeat/46635>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [April 7, 2016, 7:45am UTC](https://discuss.elastic.co/t/can-i-tag-the-events-using-winlogbeat/46635 "2016-04-07T07:45:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![thyfere](https://avatars.discourse-cdn.com/v4/letter/t/48db29/32.png) [@thyfere](https://discuss.elastic.co/u/thyfere)\
**Post date:** [April 7, 2016, 7:45am UTC](https://discuss.elastic.co/t/can-i-tag-the-events-using-winlogbeat/46635/1 "2016-04-07T07:45:08Z")

</div>

Hi,

I am shipping auditing logs from Windows machines, I am already using a different index for auditing logs which is different than Windows Domain Controller logs. Can I tag the logs using Winlogbeats?

---

<div class="post-metadata">

**Author:** ![mourlos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mourlos/32/10788_2.png) [@mourlos](https://discuss.elastic.co/u/mourlos)\
**Post date:** [April 7, 2016, 12:31pm UTC](https://discuss.elastic.co/t/can-i-tag-the-events-using-winlogbeat/46635/2 "2016-04-07T12:31:47Z")

</div>

Yes it is possible.  
In this section of the winlogbeat you can specify the tag that all the logs from that beat will have

[CODE]  
shipper:  
tags: Name\_of\_the\_tag  
fields:

[/CODE]

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [April 7, 2016, 3:47pm UTC](https://discuss.elastic.co/t/can-i-tag-the-events-using-winlogbeat/46635/3 "2016-04-07T15:47:46Z")

</div>

In version 5 you can also apply tags and fields in the `event_logs` config. See [https://www.elastic.co/guide/en/beats/winlogbeat/master/configuration-winlogbeat-options.html#\_event\_logs\_tags](https://www.elastic.co/guide/en/beats/winlogbeat/master/configuration-winlogbeat-options.html#_event_logs_tags)

```auto
winlogbeat:
  event_logs:
    - name: CustomLog
      tags: ["web"]

```

```auto
winlogbeat:
  event_logs:
    - name: CustomLog
      fields:
        customer_id: 51415432

```

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [April 12, 2016, 1:51pm UTC](https://discuss.elastic.co/t/can-i-tag-the-events-using-winlogbeat/46635/4 "2016-04-12T13:51:20Z")

</div>