# Logstash Add Tag if Message Starts With

**URL:** <https://discuss.elastic.co/t/logstash-add-tag-if-message-starts-with/228607>\
**Category:** Logstash\
**Created:** [April 18, 2020, 2:37am UTC](https://discuss.elastic.co/t/logstash-add-tag-if-message-starts-with/228607 "2020-04-18T02:37:33Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ericbarnes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ericbarnes/32/31868_2.png) [@ericbarnes](https://discuss.elastic.co/u/ericbarnes)\
**Post date:** [April 18, 2020, 2:37am UTC](https://discuss.elastic.co/t/logstash-add-tag-if-message-starts-with/228607/1 "2020-04-18T02:37:34Z")

</div>

We are using the Jenkins logstash plugin. So the logstash config is just an input and ouput. The plugin sends pre-formatted json, so not much to do besides collect and forward. We want to enrich based off the type of log sent to the Jenkins console.

We are attempting to add a tag to Jenkins console logs if the message output start with a particular character. The message could start with an I, W, or E and we want to say "if message starts with W, add tag "warning" or "if message starts with E, add tag "error." How can i add a filter that says, "if it starts with x, add y, OR if is starts x1 add y1, OR if it starts with x2 add y2, else just pass the message through?

Example message fields:

W0418 02:00:29.358414 74475 Report.cc:188] Total Duration : 6 min, 24 secs

I0418 02:00:29.358414 74475 Report.cc:188] Total Duration : 6 min, 24 secs

E0418 02:00:29.358414 74475 Report.cc:188] Total Duration : 6 min, 24 secs

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 18, 2020, 5:08pm UTC](https://discuss.elastic.co/t/logstash-add-tag-if-message-starts-with/228607/2 "2020-04-18T17:08:56Z")

</div>

Use grok to parse the first character off

```
grok { match => { "message" => "^(?<[@metadata][char]>.)" } }

```

Then use a translate filter to map that.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 16, 2020, 5:09pm UTC](https://discuss.elastic.co/t/logstash-add-tag-if-message-starts-with/228607/3 "2020-05-16T17:09:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.