# EREG in input to apply in tags value

**URL:** <https://discuss.elastic.co/t/ereg-in-input-to-apply-in-tags-value/65328>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 8, 2016, 9:39am UTC](https://discuss.elastic.co/t/ereg-in-input-to-apply-in-tags-value/65328 "2016-11-08T09:39:43Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mcortinas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mcortinas/32/3859_2.png) [@mcortinas](https://discuss.elastic.co/u/mcortinas)\
**Post date:** [November 8, 2016, 9:39am UTC](https://discuss.elastic.co/t/ereg-in-input-to-apply-in-tags-value/65328/1 "2016-11-08T09:39:43Z")

</div>

Hi,

I'm starting working with filebeat and I want add tag with the value of regular expression in path

```auto
filebeat.prospectors:
- paths:
    - /mnt/ssd/(.*).log --> EREG to obtain the application name 
  tags: [$app] --> tagging with the application name
 ....

```

Could I do this? Apologies for my english, I tried to explain me as well as I can.

I think this feature could be expand CPU resources but i think simplifies the redeploy filebeat docker

Best,  
Marc

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [November 8, 2016, 1:34pm UTC](https://discuss.elastic.co/t/ereg-in-input-to-apply-in-tags-value/65328/2 "2016-11-08T13:34:58Z")

</div>

What you mean with expand/add tag with the value of a regular expression? You want to set a different tag per log line?

Filebeat currently does not parse/grok content. To me this sounds like a task for Logstash or elasticsearch ingest node.

---

<div class="post-metadata">

**Author:** ![mcortinas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mcortinas/32/3859_2.png) [@mcortinas](https://discuss.elastic.co/u/mcortinas)\
**Post date:** [November 9, 2016, 11:14am UTC](https://discuss.elastic.co/t/ereg-in-input-to-apply-in-tags-value/65328/3 "2016-11-09T11:14:13Z")

</div>

Yes! Let me share my use case

I'm working in cloud environment there are new application every week  
It could be useful add a tag value parsed from file path dinamycally without restart the filebeat.  
Personally, I think it could be possible for new versions of filebeat, metricbeat or any log shipper application...

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [November 10, 2016, 12:52pm UTC](https://discuss.elastic.co/t/ereg-in-input-to-apply-in-tags-value/65328/4 "2016-11-10T12:52:03Z")

</div>

While it's not fully clear to me how you want to compute the tag in a general way (especially for metricbeat), it sounds like [this enhancement request](https://github.com/elastic/beats/issues/2186) might be helpful.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 8, 2016, 12:52pm UTC](https://discuss.elastic.co/t/ereg-in-input-to-apply-in-tags-value/65328/5 "2016-12-08T12:52:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.