# Choosing filed and tag in filebeat

**URL:** https://discuss.elastic.co/t/choosing-filed-and-tag-in-filebeat/120914
**Category:** Beats
**Tags:** filebeat
**Created:** [February 21, 2018, 6:33pm UTC](https://discuss.elastic.co/t/choosing-filed-and-tag-in-filebeat/120914 "2018-02-21T18:33:57Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![nsphaniraj](https://avatars.discourse-cdn.com/v4/letter/n/7feea3/32.png) [@nsphaniraj](https://discuss.elastic.co/u/nsphaniraj)
#### Post date: [February 21, 2018, 6:33pm UTC](https://discuss.elastic.co/t/choosing-filed-and-tag-in-filebeat/120914/1 "2018-02-21T18:33:57Z")

</div>

Hello,

I am trying to understand if we have to use field or tag in filebeat prospectors. What are the use cases of using fields and tags? When should we use fields over tags? Is there any performance impact on elasticsearch on using tags over fields or vice versa?

Thanks  
Phaniraj

---

<div class="post-metadata">

### Author: ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)
#### Post date: [February 22, 2018, 9:46am UTC](https://discuss.elastic.co/t/choosing-filed-and-tag-in-filebeat/120914/2 "2018-02-22T09:46:00Z")

</div>

it depends on your use case. I doubt there is a noticeable performance impact on using one or the other.

Fields are more flexible and better suited to embed custom information. They are the way to go if you want to process this data at a later stage (logstash or input pipeline).

Tags are simpler and meant to label the events, for filtering or aggregation.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 22, 2018, 9:46am UTC](https://discuss.elastic.co/t/choosing-filed-and-tag-in-filebeat/120914/3 "2018-03-22T09:46:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
