# Find length of 'tag' attribute

**URL:** <https://discuss.elastic.co/t/find-length-of-tag-attribute/119415>\
**Category:** Logstash\
**Created:** [February 12, 2018, 6:18am UTC](https://discuss.elastic.co/t/find-length-of-tag-attribute/119415 "2018-02-12T06:18:33Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![dsakpal](https://avatars.discourse-cdn.com/v4/letter/d/c2a13f/32.png) [@dsakpal](https://discuss.elastic.co/u/dsakpal)\
**Post date:** [February 12, 2018, 6:18am UTC](https://discuss.elastic.co/t/find-length-of-tag-attribute/119415/1 "2018-02-12T06:18:33Z")

</div>

Hi,

How to find length/size of 'tag' attribute in logstash(output section)?

My scenario : All my errors are automatically puts into the 'tag' attribute by logstash & thats why I wanted to know the size of 'tag' attribute so that I will make my decision in output section whether parse record having some error or successfully done the parsing.

Thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 12, 2018, 7:40am UTC](https://discuss.elastic.co/t/find-length-of-tag-attribute/119415/2 "2018-02-12T07:40:07Z")

</div>

You'd have to use a filter to e.g. add an additional tag ("too many tags") or a field that you can inspect in a conditional in the output section.

---

<div class="post-metadata">

**Author:** ![dsakpal](https://avatars.discourse-cdn.com/v4/letter/d/c2a13f/32.png) [@dsakpal](https://discuss.elastic.co/u/dsakpal)\
**Post date:** [February 12, 2018, 9:21am UTC](https://discuss.elastic.co/t/find-length-of-tag-attribute/119415/3 "2018-02-12T09:21:43Z")

</div>

Ok .... but how do I increment that field in filter section, I mean how to handle it in filter section. Can you please give me some example code so that it will be more easy for me to implement it.

For example:  
Data and beats\_input\_codec\_plain\_applied are added in the tags in my logstash code. But any parsing error in csv or JSON it give \_csvparsefailure and \_jsonparsefailure in tags field.

I want to implement output logic such a way that if two tags found insert in ElasticIndex and more than 2 tags insert in Errorindex

Thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 12, 2018, 12:59pm UTC](https://discuss.elastic.co/t/find-length-of-tag-attribute/119415/4 "2018-02-12T12:59:13Z")

</div>

A ruby filter containing

```
event.set('tag_count', event.get('tags').length)

```

probably works (i.e. sets the `tag_count` field to the number of tags in the event). Then you can use

```
if [tag_count] > 2 { ... }

```

in the output section. If you don't want to keep the `tag_count` field you can create it as a subfield of `@metadata` instead.

---

<div class="post-metadata">

**Author:** ![dsakpal](https://avatars.discourse-cdn.com/v4/letter/d/c2a13f/32.png) [@dsakpal](https://discuss.elastic.co/u/dsakpal)\
**Post date:** [February 12, 2018, 1:31pm UTC](https://discuss.elastic.co/t/find-length-of-tag-attribute/119415/5 "2018-02-12T13:31:29Z")

</div>

Thanks ..... Done with my work 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 12, 2018, 1:31pm UTC](https://discuss.elastic.co/t/find-length-of-tag-attribute/119415/6 "2018-03-12T13:31:39Z")

</div>

Closed on March 12, 2018, 1:31pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.