# Logstash add tags

**URL:** <https://discuss.elastic.co/t/logstash-add-tags/157115>\
**Category:** Logstash\
**Created:** [November 16, 2018, 5:31pm UTC](https://discuss.elastic.co/t/logstash-add-tags/157115 "2018-11-16T17:31:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![garcia](https://avatars.discourse-cdn.com/v4/letter/g/ecc23a/32.png) [@garcia](https://discuss.elastic.co/u/garcia)\
**Post date:** [November 16, 2018, 5:31pm UTC](https://discuss.elastic.co/t/logstash-add-tags/157115/1 "2018-11-16T17:31:43Z")

</div>

elk is installed, logs from filebeat come from another server  
logs in format

```
2018-11-16 17:26:12 [http-nio-127.0.0.1-8080-exec-6] DEBUG c.j.m.helpers.EmailHelper - MAIL WAS SENT, manage post
Fri Nov 16 17:26:12 UTC 2018 WARN: Establishing SSL connection without server's identity verification is not recommended. According to MySQL 5.5.45+, 5.6.26+ and 5.7.6+ requirements SSL connection must be established by default if explicit option isn't set. For compliance with existing applications not using SSL the verifyServerCertificate property is set to 'false'. You need either to explicitly disable SSL by setting useSSL=false, or set useSSL=true and provide truststore for server certificate verification.
2018-11-16 17:26:12 [http-nio-127.0.0.1-8080-exec-91] ERROR c.j.m.c.e.PostExceptionController - You are only allowed to post once every 15m.
Come back a little later [in 00:14:57]

```

how can I set up a DEBUG WARN ERROR sample in kibana, I need to set up a tag or field or something else, tell me how

---

<div class="post-metadata">

**Author:** ![garcia](https://avatars.discourse-cdn.com/v4/letter/g/ecc23a/32.png) [@garcia](https://discuss.elastic.co/u/garcia)\
**Post date:** [November 19, 2018, 8:14am UTC](https://discuss.elastic.co/t/logstash-add-tags/157115/2 "2018-11-19T08:14:39Z")

</div>

add logstash

```
filter {
    grok {
        match => {
            "message" => "%{LOGLEVEL:loglevel}"
        }
    }
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 17, 2018, 8:17am UTC](https://discuss.elastic.co/t/logstash-add-tags/157115/3 "2018-12-17T08:17:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.