# From logstash-forwarder to filebeat, how can use tags?

**URL:** <https://discuss.elastic.co/t/from-logstash-forwarder-to-filebeat-how-can-use-tags/52730>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 14, 2016, 12:13pm UTC](https://discuss.elastic.co/t/from-logstash-forwarder-to-filebeat-how-can-use-tags/52730 "2016-06-14T12:13:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![stefanocog](https://avatars.discourse-cdn.com/v4/letter/s/5fc32e/32.png) [@stefanocog](https://discuss.elastic.co/u/stefanocog)\
**Post date:** [June 14, 2016, 12:13pm UTC](https://discuss.elastic.co/t/from-logstash-forwarder-to-filebeat-how-can-use-tags/52730/1 "2016-06-14T12:13:31Z")

</div>

Hi, i have converted my old configuration for logstash-forwarder to filebeat, in this way:

```
filebeat:
  prospectors:
    -
     paths:
       - /var/log/httpd/access_log
     input_type: log
     document_type: apache
     fields:
       tags: {"mytag"}
     fields_under_root: true

##### Output ####

output:
  logstash:
    hosts: ["logstash_ip"]

##### Logging ####

logging:
  to_files: true
  files:
    path: /var/log/mybeat
    name: mybeat
    rotateeverybytes: 10485760 # = 10MB
  level: info

```

I have correctly installed input-beat-plugin into logstash server, this is my logstash output conf:

```
output {
  elasticsearch {
    hosts => "localhost:9200"
    manage_template => false
    index => "logstash-%{tags}-%{+YYYY.MM.dd}"
  }
}

```

Now the elasticsearch indexes are `logstash-mytagbeats_input_codec_plain_applied-2016.06.14`  
How can manage the tags?

---

<div class="post-metadata">

**Author:** ![stefanocog](https://avatars.discourse-cdn.com/v4/letter/s/5fc32e/32.png) [@stefanocog](https://discuss.elastic.co/u/stefanocog)\
**Post date:** [June 14, 2016, 3:09pm UTC](https://discuss.elastic.co/t/from-logstash-forwarder-to-filebeat-how-can-use-tags/52730/2 "2016-06-14T15:09:32Z")

</div>

I have resolved inserting a filter to logstash:

```
filter {
    if "beats_input_codec_plain_applied" in [tags] {
        mutate {
            remove_tag => ["beats_input_codec_plain_applied"]
        }
    }
}

```

Thanks'all

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2016, 12:13pm UTC](https://discuss.elastic.co/t/from-logstash-forwarder-to-filebeat-how-can-use-tags/52730/3 "2016-07-05T12:13:31Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.