# Filebeat: How can I add tags to module input in filebeat?

**URL:** <https://discuss.elastic.co/t/filebeat-how-can-i-add-tags-to-module-input-in-filebeat/276781>\
**Category:** Beats\
**Tags:** beats-module, filebeat\
**Created:** [June 23, 2021, 11:13am UTC](https://discuss.elastic.co/t/filebeat-how-can-i-add-tags-to-module-input-in-filebeat/276781 "2021-06-23T11:13:31Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![connectgeeks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/connectgeeks/32/90595_2.png) [@connectgeeks](https://discuss.elastic.co/u/connectgeeks)\
**Post date:** [June 23, 2021, 11:13am UTC](https://discuss.elastic.co/t/filebeat-how-can-i-add-tags-to-module-input-in-filebeat/276781/1 "2021-06-23T11:13:31Z")

</div>

I'm using filebeat module and want to use tag so that I can process different input files based on tags. How can I achieve that ? Below tags doesn't seems to work.

modules.d/elasticsearch.yml

```auto
- module: elasticsearch
  server:
    enabled: true
    var.paths:
      - /var/logs/folder1/*
    tags: ["app1"]

```

filebeat.yml

```auto
- type: log
  enabled: true
  paths:
    - /var/logs/folder2/*
  scan_frequency: 10s
  ignore_older: 4h
  tags: ["app2"]

```

---

<div class="post-metadata">

**Author:** ![Kaiyan\_Sheng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaiyan_sheng/32/38247_2.png) [@Kaiyan\_Sheng](https://discuss.elastic.co/u/Kaiyan_Sheng)\
**Post date:** [June 24, 2021, 2:58am UTC](https://discuss.elastic.co/t/filebeat-how-can-i-add-tags-to-module-input-in-filebeat/276781/2 "2021-06-24T02:58:50Z")

</div>

We have a processor you can use to add tags, please see  
[Add tags | Filebeat Reference [7.13] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/add-tags.html) for more details. So basically you can add a processor

```auto
- type: log
  enabled: true
  paths:
    - /var/logs/folder2/*
  scan_frequency: 10s
  ignore_older: 4h
processors:
  - add_tags:
      tags: [value]
      target: "tag name"

```

---

<div class="post-metadata">

**Author:** ![nemhods](https://avatars.discourse-cdn.com/v4/letter/n/48db29/32.png) [@nemhods](https://discuss.elastic.co/u/nemhods)\
**Post date:** [July 18, 2021, 1:04pm UTC](https://discuss.elastic.co/t/filebeat-how-can-i-add-tags-to-module-input-in-filebeat/276781/3 "2021-07-18T13:04:33Z")

</div>

Hey, this works for filebeat inputs - but not for modules, correct?

```auto
filebeat.modules:
  - module: o365
    audit:
      enabled: true
      var.application_id: "x"
      var.tenants:
        - id: "x"
          name: "x"
      var.client_secret: "x"
    processors:
      - add_tags:
        tags: ["o365"]

```

gives me

```auto
Exiting: fileset o365/processors is configured but doesn't exist

```

is there any other way to add tags to _module_ data?

---

<div class="post-metadata">

**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\
**Post date:** [July 18, 2021, 7:54pm UTC](https://discuss.elastic.co/t/filebeat-how-can-i-add-tags-to-module-input-in-filebeat/276781/4 "2021-07-18T19:54:00Z")

</div>

Some modules have a setting called `var.tags` which accepts a list of tags.

---

<div class="post-metadata">

**Author:** ![mangeshmj1992](https://avatars.discourse-cdn.com/v4/letter/m/d9b06d/32.png) [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\
**Post date:** [July 19, 2021, 6:38am UTC](https://discuss.elastic.co/t/filebeat-how-can-i-add-tags-to-module-input-in-filebeat/276781/5 "2021-07-19T06:38:36Z")

</div>

@connectgeeks ,  
try to use below code. it will work fine:  
By using Fields you can create more fields and you do not need to use tags as well:

```auto
- type: log
  enabled: true
  paths:
    - /var/logs/folder2/*
  scan_frequency: 10s
  ignore_older: 4h
  fields:
     Field Name1: value 1
     Field Name2: value 2
    

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 16, 2021, 8:39am UTC](https://discuss.elastic.co/t/filebeat-how-can-i-add-tags-to-module-input-in-filebeat/276781/6 "2021-08-16T08:39:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.