# Insert tags input beats in logstash not work

**URL:** <https://discuss.elastic.co/t/insert-tags-input-beats-in-logstash-not-work/120225>\
**Category:** Logstash\
**Created:** [February 16, 2018, 5:24pm UTC](https://discuss.elastic.co/t/insert-tags-input-beats-in-logstash-not-work/120225 "2018-02-16T17:24:06Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![gonzauy](https://avatars.discourse-cdn.com/v4/letter/g/6f9a4e/32.png) [@gonzauy](https://discuss.elastic.co/u/gonzauy)\
**Post date:** [February 16, 2018, 5:24pm UTC](https://discuss.elastic.co/t/insert-tags-input-beats-in-logstash-not-work/120225/1 "2018-02-16T17:24:06Z")

</div>

I need make multiple input in logstash and then multiple output.

I have this configuration and I need if the events in on port 5055 tag with "docker" and then add a field and output to elasticsearch.

The command tags =\> ["docker"] , not work the event still show the tag "tags":["beats\_input\_codec\_plain\_applied"]

input {  
beats {  
port =\> 5044  
id =\> "comex"  
}  
beats {  
port =\> 5055  
tags =\> ["docker"]  
}  
}

filter {  
if "docker" in [tags] {  
mutate { add\_field =\> { "message\_aux" =\> "docker" } }  
}  
}

output {  
if "docker" in [tags] {  
elasticsearch {  
hosts =\> ["127.0.0.1:9200"]  
index =\> "docker2"  
}  
}  
elasticsearch {  
hosts =\> ["127.0.0.1:9200"]  
index =\> "comex-%{+YYYY.MM.dd}"  
}

file {  
path =\> "/tmp/logstash.txt"  
}  
}

This in one of the events output.

{"count":1,"message":"[api-accounts.2.vlwxdyvzh1tzs2y3ka0x19u01] \u0001\u0000[api-accounts.2.vlwxdyvzh1tzs2y3ka0x19u01] \u0000[api-accounts.2.vlwxdyvzh1tzs2y3ka0x19u01] ","input\_type":"stdin","fields":null,"@timestamp":"2018-02-16T15:51:56.451Z","tags":["beats\_input\_codec\_plain\_applied"],"offset":151155522,"beat":{"hostname":"e080a9066ea7","name":"docker01.bbva.internal"},"source":"-","type":"filebeat-docker-logs","host":"e080a9066ea7","@version":"1"}

also I probe with

beats {  
port =\> 5055  
add\_field =\> {  
"origen" =\> "docker"  
}  
}

and does not work.

This a bug ? How can I do this?

Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 16, 2018, 5:24pm UTC](https://discuss.elastic.co/t/insert-tags-input-beats-in-logstash-not-work/120225/2 "2018-03-16T17:24:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.