# Filebeat tags not applied, if JSON event already has a tags field?
**URL:** https://discuss.elastic.co/t/filebeat-tags-not-applied-if-json-event-already-has-a-tags-field/102974
**Category:** Beats
**Tags:** filebeat
**Created:** [October 6, 2017, 8:39am UTC](https://discuss.elastic.co/t/filebeat-tags-not-applied-if-json-event-already-has-a-tags-field/102974 "2017-10-06T08:39:02Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@uschtwill](https://discuss.elastic.co/u/uschtwill)
#### Post date: [October 6, 2017, 8:39am UTC](https://discuss.elastic.co/t/filebeat-tags-not-applied-if-json-event-already-has-a-tags-field/102974/1 "2017-10-06T08:39:02Z")
I have spent quite some time trying to add some tags to Kibana logs yesterday - futilely.
The Kibana logs are in JSON and already contain a "tags" field. The way it looks, Filebeat (maybe beats in general?) chooses not to add tags to an event, if the event has a pre-existing "tags" field - regardless of wether the tags are added via the prospector or "generally".
Is this possible?
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [October 6, 2017, 10:51am UTC](https://discuss.elastic.co/t/filebeat-tags-not-applied-if-json-event-already-has-a-tags-field/102974/2 "2017-10-06T10:51:50Z")
Can you share your config? Beats expects `tags` to be an array of strings.
---
### Author:  [@uschtwill](https://discuss.elastic.co/u/uschtwill)
#### Post date: [October 6, 2017, 11:30am UTC](https://discuss.elastic.co/t/filebeat-tags-not-applied-if-json-event-already-has-a-tags-field/102974/3 "2017-10-06T11:30:27Z")
Sure:
```auto
filebeat:
# List of prospectors to fetch data.
prospectors:
[{"paths": ["/var/log/*.log", "/var/log/redacted/kibana.json"], "tags": ["filebeat", "filebeat-dev"], "ignore_older": "24h", "encoding": "utf-8", "field": {"type": "filebeatlog"}, "registry_file": "/var/lib/filebeat/registry", "input_type": "log"}]
```
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [October 8, 2017, 10:40am UTC](https://discuss.elastic.co/t/filebeat-tags-not-applied-if-json-event-already-has-a-tags-field/102974/4 "2017-10-08T10:40:44Z")
You also have a sample log event? The `tags` field must be an array of strings. Checking the source code there might indeed be a problem with the JSON parser not representing the array with the assumed types.
---
### Author:  [@uschtwill](https://discuss.elastic.co/u/uschtwill)
#### Post date: [October 12, 2017, 6:03pm UTC](https://discuss.elastic.co/t/filebeat-tags-not-applied-if-json-event-already-has-a-tags-field/102974/5 "2017-10-12T18:03:31Z")
They're really just normal Kibana JSON logs, and `tags` also contains proper strings:
```auto
{"type":"log","@timestamp":"2017-08-22T09:11:11Z","tags":["status","plugin:kibana@5.4.0","info"],"pid":17341,"state":"green","message":"Status changed from uninitialized to green - Ready","prevState":"uninitialized","prevMsg":"uninitialized"}
{"type":"log","@timestamp":"2017-08-22T09:11:11Z","tags":["status","plugin:elasticsearch@5.4.0","info"],"pid":17341,"state":"yellow","message":"Status changed from uninitialized to yellow - Waiting for Elasticsearch","prevState":"uninitialized","prevMsg":"uninitialized"}
```
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [October 13, 2017, 1:01pm UTC](https://discuss.elastic.co/t/filebeat-tags-not-applied-if-json-event-already-has-a-tags-field/102974/6 "2017-10-13T13:01:39Z")
Thanks. I'd say this is a bug in the parsing/normalization code in filebeat. The post-processing should try to convert the `tags` value to it's proper type.
I filed [this bug report](https://github.com/elastic/beats/issues/5389). Feel free to add any context/config/logs/events that might help. Btw. it's tagged for [Hacktoberfest](https://hacktoberfest.digitalocean.com) if you want to give it a shot 😉
---
### Author:  [@uschtwill](https://discuss.elastic.co/u/uschtwill)
#### Post date: [October 13, 2017, 3:07pm UTC](https://discuss.elastic.co/t/filebeat-tags-not-applied-if-json-event-already-has-a-tags-field/102974/7 "2017-10-13T15:07:50Z")
Thanks, for following up on this, you're welcome. 🙂
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 10, 2017, 3:07pm UTC](https://discuss.elastic.co/t/filebeat-tags-not-applied-if-json-event-already-has-a-tags-field/102974/8 "2017-11-10T15:07:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.