# Create index from tags (basic question ?) **URL:** \ **Category:** Logstash\ **Created:** [April 6, 2016, 6:58am UTC](https://discuss.elastic.co/t/create-index-from-tags-basic-question/46482 "2016-04-06T06:58:17Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![smutel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/smutel/32/75550_2.png) [@smutel](https://discuss.elastic.co/u/smutel)\ **Post date:** [April 6, 2016, 6:58am UTC](https://discuss.elastic.co/t/create-index-from-tags-basic-question/46482/1 "2016-04-06T06:58:17Z")
Hello, I would like to create index to split data regarding the application for example. Is-it a good idea to use tags for that ? If yes, how can I convert tags from array to string ? Because when I want to use tags, logstash tell me that I can't put tags which is an array in index which is a string. Is-it possible to create a loop like foreach on tags ?? Thanks. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 6, 2016, 7:02am UTC](https://discuss.elastic.co/t/create-index-from-tags-basic-question/46482/2 "2016-04-06T07:02:49Z")
Do you really want to create indexes based on _all_ tags? That's probably not a good idea. Can you give an example of the kind of tags you have? ---
**Author:** ![smutel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/smutel/32/75550_2.png) [@smutel](https://discuss.elastic.co/u/smutel)\ **Post date:** [April 6, 2016, 7:51am UTC](https://discuss.elastic.co/t/create-index-from-tags-basic-question/46482/3 "2016-04-06T07:51:11Z")
The need is to split index on some criteria. For management, for curator, for data space allocation, ... And give the capability to the sender to set the name of the application. For example: - All messages received from this queue are APPLICATION - And tags contains APP\_TOTO Then index is: - APPLICATION-APP\_TOTO-%{+YYYY.MM.dd} But I don't want to fix APP\_TOTO, i don't want this piece of code: if 'APP\_TOTO' in [tags] ... I would like something more dynamic. Not a good idea ? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 6, 2016, 7:53am UTC](https://discuss.elastic.co/t/create-index-from-tags-basic-question/46482/4 "2016-04-06T07:53:58Z")
You need to be very careful of shard explosion (kagillion shard problem) here. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 6, 2016, 10:21am UTC](https://discuss.elastic.co/t/create-index-from-tags-basic-question/46482/5 "2016-04-06T10:21:58Z")
I think it's a mistake to use tags in this way. Why not put the application name in its own field? It needs to have a singular value anyway and you don't lock the use of the tags to what you need to build up your index name. A concrete problem would be if you have a grok filter that fails for certain kinds of input. Suddenly those events end up in another index with an extra "\_grokparsefailure" in its name. ---
**Author:** ![smutel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/smutel/32/75550_2.png) [@smutel](https://discuss.elastic.co/u/smutel)\ **Post date:** [April 6, 2016, 12:16pm UTC](https://discuss.elastic.co/t/create-index-from-tags-basic-question/46482/6 "2016-04-06T12:16:28Z")
I am sorry but I didn't find the field application that you mention. Currently I receive logs from syslog and winlogbeat and I don't find this field. Is-it a custom field? For example if in one application I setup log4j to use syslog, How to setup the field application? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 6, 2016, 12:46pm UTC](https://discuss.elastic.co/t/create-index-from-tags-basic-question/46482/7 "2016-04-06T12:46:05Z")
You currently use a custom tag to indicate which application an event comes from. My point is that you might just as well use a custom field to accomplish the same thing. I can't give any specific advice without knowing how the application tags end up in the events. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:03am UTC](https://discuss.elastic.co/t/create-index-from-tags-basic-question/46482/8 "2017-07-06T05:03:31Z")