# Logmessage map to tags or fields
**URL:** https://discuss.elastic.co/t/logmessage-map-to-tags-or-fields/36259
**Category:** Elasticsearch
**Created:** [December 3, 2015, 8:42am UTC](https://discuss.elastic.co/t/logmessage-map-to-tags-or-fields/36259 "2015-12-03T08:42:04Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@jayaram](https://discuss.elastic.co/u/jayaram)
#### Post date: [December 3, 2015, 8:42am UTC](https://discuss.elastic.co/t/logmessage-map-to-tags-or-fields/36259/1 "2015-12-03T08:42:04Z")
Continuing the discussion from [Any Help Un-structure log message to map structure message in Logstash](https://discuss.elastic.co/t/any-help-un-structure-log-message-to-map-structure-message-in-logstash/36258):
> [@Any Help Un-structure log message to map structure message in Logstash](https://discuss.elastic.co/t/any-help-un-structure-log-message-to-map-structure-message-in-logstash/36258/1):
>
> Hello, I have the log message
> 2015-11-18 21:11:38,693 [WARN] [xx.web.common.filter.RequestFilter] NDC[UserPrincipal(ABCDF22602)] request (/member/control/loginAction) exceeded threshold; elapsed milliseconds since start: 188814
>
> Can any one help me. How to tag or map the each same stored/moved to elasticsearch or any output resource
>
> dose GROK plugin help for this mapping? any other plugin available to map/associate the each value to some TAG
> I am trying like this in grok plugin but not working
>
> match =\> { "timestamp" =\> "%{TOMCAT\_DATESTAMP:timestamp}"}
> match =\> { "level" =\> "[%{LOGLEVEL:level}]" }
> match =\> { "class" =\> "[%{JAVACLASS:class}]" }
> match =\> { "logmessage" =\> "%{JAVALOGMESSAGE:logmessage}" }
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 3, 2015, 8:47am UTC](https://discuss.elastic.co/t/logmessage-map-to-tags-or-fields/36259/2 "2015-12-03T08:47:09Z")
This is a Logstash question so I'm not sure why you want to continue the discussion in the Elasticsearch group.
---
### Author:  [@jayaram](https://discuss.elastic.co/u/jayaram)
#### Post date: [December 3, 2015, 9:25am UTC](https://discuss.elastic.co/t/logmessage-map-to-tags-or-fields/36259/3 "2015-12-03T09:25:55Z")
i thought it stored in elasticsearrch so same mapping need in elasticsearch
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 3, 2015, 9:29am UTC](https://discuss.elastic.co/t/logmessage-map-to-tags-or-fields/36259/4 "2015-12-03T09:29:26Z")
Yes, Logstash can store data in Elasticsearch. If you use the grok filter as described in the other thread you'll get your log entries stored in Elasticsearch with separate fields for the timestamp, log level, class name, and so on. No further action is necessary on the Elasticsearch side.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 11:33pm UTC](https://discuss.elastic.co/t/logmessage-map-to-tags-or-fields/36259/5 "2017-07-05T23:33:56Z")