# Common Option 'id' in input plugin

**URL:** <https://discuss.elastic.co/t/common-option-id-in-input-plugin/235388>\
**Category:** Logstash\
**Created:** [June 2, 2020, 5:52pm UTC](https://discuss.elastic.co/t/common-option-id-in-input-plugin/235388 "2020-06-02T17:52:32Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![beyondcompare](https://avatars.discourse-cdn.com/v4/letter/b/90ced4/32.png) [@beyondcompare](https://discuss.elastic.co/u/beyondcompare)\
**Post date:** [June 2, 2020, 5:52pm UTC](https://discuss.elastic.co/t/common-option-id-in-input-plugin/235388/1 "2020-06-02T17:52:33Z")

</div>

Dear all,

Thank you very much for your time to read my question.

I have created a config file with the the input section shown below.

input {  
file {  
path =\> [  
"/var/log/messages"  
]  
id =\> "syslog"  
tags =\> "syslog"  
}  
}

I understand the deprecation of 'type' and thus I have used 'tags' extensively. However, I'm also aware that seeking a value from a list can be less efficient and would like to use 'id' here for a condition critera. For example, under 'filter' section, I'd like to have:-

filter {  
if [id] == "syslog" { do one thing} # however this doesn't work  
if "syslog" in [tags] { do one thing} # this works  
else {do another}  
}

Grateful if you could instruct how I can use 'id' in this case? I'm unable to find any information from the document.

Many thanks in advance,

James Ren

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 2, 2020, 7:23pm UTC](https://discuss.elastic.co/t/common-option-id-in-input-plugin/235388/2 "2020-06-02T19:23:26Z")

</div>

The id option is not added to the events that an input generates. It is used to label the statistics about the input that you can access using the monitoring API.

If you want to add additional fields to the events use the add\_field common option.

---

<div class="post-metadata">

**Author:** ![beyondcompare](https://avatars.discourse-cdn.com/v4/letter/b/90ced4/32.png) [@beyondcompare](https://discuss.elastic.co/u/beyondcompare)\
**Post date:** [June 2, 2020, 8:03pm UTC](https://discuss.elastic.co/t/common-option-id-in-input-plugin/235388/3 "2020-06-02T20:03:06Z")

</div>

Thank you, that makes sense.

Would there be any performance penalty for 'adding a field' and then 'remove the field' before output?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 2, 2020, 8:29pm UTC](https://discuss.elastic.co/t/common-option-id-in-input-plugin/235388/4 "2020-06-02T20:29:21Z")

</div>

Well the operation is not free, but adding a field to a hash (which is what it is doing) is a pretty cheap operation.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 30, 2020, 8:29pm UTC](https://discuss.elastic.co/t/common-option-id-in-input-plugin/235388/5 "2020-06-30T20:29:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.