# Creating a dynamic S3 tag

**URL:** <https://discuss.elastic.co/t/creating-a-dynamic-s3-tag/224455>\
**Category:** Logstash\
**Created:** [March 20, 2020, 4:47pm UTC](https://discuss.elastic.co/t/creating-a-dynamic-s3-tag/224455 "2020-03-20T16:47:29Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![byoungman](https://avatars.discourse-cdn.com/v4/letter/b/838e76/32.png) [@byoungman](https://discuss.elastic.co/u/byoungman)\
**Post date:** [March 20, 2020, 4:47pm UTC](https://discuss.elastic.co/t/creating-a-dynamic-s3-tag/224455/1 "2020-03-20T16:47:29Z")

</div>

I have log input coming from multiple sources that I am writing into S3 buckets but now I am wanting to add the source name (machine name) to the S3 filename as a tag so my requirement is a dynamic tag name based on the different machine names that will then be added as a tag.

My current configuration is-

```
filter {
	mutate {
		add_field => {
			"filepath" => '%{[log][file][path]}' 
		}
	}
	
	grok {
		match => ["filepath", "%{WORD:filepath}.log"]
		overwrite => ["filepath"]
	}
 }

output {
     s3 {
          ....
	 tags => ["%{filepath}"]
    }
}

```

The filenames in S3 is

ls.s3.3791f296-2b0e-4750-a868-a668a5b98e61.2020-03-20T12.32. **tag\_%{filepath}**.part8

So what am I missing and can what I want to do be done with the S3 tag property.

TIA,  
Bill

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 22, 2020, 5:11pm UTC](https://discuss.elastic.co/t/creating-a-dynamic-s3-tag/224455/2 "2020-03-22T17:11:02Z")

</div>

> [@byoungman](#):
>
> So what am I missing and can what I want to do be done with the S3 tag property.

No, it cannot be done. The [code that adds tags](https://github.com/logstash-plugins/logstash-output-s3/blob/ba1770c21da075f06ab570f19252cf452ae373ae/lib/logstash/outputs/s3/temporary_file_factory.rb#L70) is just a concatenation of strings in an array. It does not event.sprintf each tag. There has been an [issue](https://github.com/logstash-plugins/logstash-output-s3/issues/168) open for this for a couple of years.

---

<div class="post-metadata">

**Author:** ![byoungman](https://avatars.discourse-cdn.com/v4/letter/b/838e76/32.png) [@byoungman](https://discuss.elastic.co/u/byoungman)\
**Post date:** [March 23, 2020, 12:27pm UTC](https://discuss.elastic.co/t/creating-a-dynamic-s3-tag/224455/3 "2020-03-23T12:27:56Z")

</div>

Thanks for the quick response Badger and I will look at another approach to this probably something like if [field][machinename] = xxxx s3 tag =\> 'machinename'

I'll let me team know this.

Bill

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 20, 2020, 12:28pm UTC](https://discuss.elastic.co/t/creating-a-dynamic-s3-tag/224455/4 "2020-04-20T12:28:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.