# Field named "tags" in logstash event causing problem

**URL:** <https://discuss.elastic.co/t/field-named-tags-in-logstash-event-causing-problem/89987>\
**Category:** Logstash\
**Created:** [June 19, 2017, 8:00pm UTC](https://discuss.elastic.co/t/field-named-tags-in-logstash-event-causing-problem/89987 "2017-06-19T20:00:48Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jaspreet\_Singh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaspreet_singh/32/58296_2.png) [@Jaspreet\_Singh](https://discuss.elastic.co/u/Jaspreet_Singh)\
**Post date:** [June 19, 2017, 8:00pm UTC](https://discuss.elastic.co/t/field-named-tags-in-logstash-event-causing-problem/89987/1 "2017-06-19T20:00:48Z")

</div>

Hi,

Here is what my configuration looks like ...  
filter {  
mutate {  
rename =\> {  
"keywords" =\> "[tags][keywords]"  
}  
}  
}

Essentially, I'm looking to mutate into a nested JSON under field named "tags".  
Now this is leading a very weird result as follows:  
"tags" =\> [  
[0] [  
[0] "keywords",  
[1] "process, new, variable"  
]  
],  
I'm guessing this could be cos perhaps logstash treats "tags" as a special keyword. In which case, how do I achieve what I want to ... have a nested JSON under "tags" field?

---

<div class="post-metadata">

**Author:** ![Jaspreet\_Singh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaspreet_singh/32/58296_2.png) [@Jaspreet\_Singh](https://discuss.elastic.co/u/Jaspreet_Singh)\
**Post date:** [June 22, 2017, 5:30pm UTC](https://discuss.elastic.co/t/field-named-tags-in-logstash-event-causing-problem/89987/2 "2017-06-22T17:30:07Z")

</div>

Any thoughts anyone?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 20, 2017, 5:30pm UTC](https://discuss.elastic.co/t/field-named-tags-in-logstash-event-causing-problem/89987/3 "2017-07-20T17:30:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.