# Logstash adding extra comma to tags

**URL:** <https://discuss.elastic.co/t/logstash-adding-extra-comma-to-tags/58863>\
**Category:** Logstash\
**Created:** [August 24, 2016, 8:52pm UTC](https://discuss.elastic.co/t/logstash-adding-extra-comma-to-tags/58863 "2016-08-24T20:52:52Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![Josh\_Reichardt](https://avatars.discourse-cdn.com/v4/letter/j/f08c70/32.png) [@Josh\_Reichardt](https://discuss.elastic.co/u/Josh_Reichardt)\
**Post date:** [August 24, 2016, 8:52pm UTC](https://discuss.elastic.co/t/logstash-adding-extra-comma-to-tags/58863/1 "2016-08-24T20:52:52Z")

</div>

I just started seeing this issue, I'm not quite sure what's up. I switched one of my environments to use the logstash+tcp functionality that recently got added to the logspout-logstash forwarder and noticed that an extra comma is being added to my custom tags. If the log doesn't hit a filter, the comma doesn't get added, and the tag column just stays blank like it should.

Here's an example of what the tags column looks like:

[![](https://cloud.githubusercontent.com/assets/1039098/17947254/cc2bf0b0-6a00-11e6-9704-b21c9df012a7.png) ](https://cloud.githubusercontent.com/assets/1039098/17947254/cc2bf0b0-6a00-11e6-9704-b21c9df012a7.png)

I've tried restarting the logspout-logstash forwarders, reverting back to the original configuration, and restarting logstash completely but the problem still persists.

Has this ever happened to anybody else? I'm not sure where to start troubleshooting this one.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 25, 2016, 5:56am UTC](https://discuss.elastic.co/t/logstash-adding-extra-comma-to-tags/58863/2 "2016-08-25T05:56:35Z")

</div>

What does the actual document in ES look like? Check the JSON tab in Kibana.

---

<div class="post-metadata">

**Author:** ![Josh\_Reichardt](https://avatars.discourse-cdn.com/v4/letter/j/f08c70/32.png) [@Josh\_Reichardt](https://discuss.elastic.co/u/Josh_Reichardt)\
**Post date:** [August 25, 2016, 4:03pm UTC](https://discuss.elastic.co/t/logstash-adding-extra-comma-to-tags/58863/3 "2016-08-25T16:03:13Z")

</div>

Here's an example of what the tags look like in the JSON view:

```auto
"tags": [
      "",
      "_grokparsefailure"
],

```

And another when the tag is empty:

```auto
"tags": [
      ""
],

```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 25, 2016, 4:36pm UTC](https://discuss.elastic.co/t/logstash-adding-extra-comma-to-tags/58863/4 "2016-08-25T16:36:32Z")

</div>

Okay, so something's inserting empty tags. What does your configuration look like?

---

<div class="post-metadata">

**Author:** ![Josh\_Reichardt](https://avatars.discourse-cdn.com/v4/letter/j/f08c70/32.png) [@Josh\_Reichardt](https://discuss.elastic.co/u/Josh_Reichardt)\
**Post date:** [August 25, 2016, 4:44pm UTC](https://discuss.elastic.co/t/logstash-adding-extra-comma-to-tags/58863/5 "2016-08-25T16:44:36Z")

</div>

I looked through the config and couldn't find anything obvious.

The config is a bit of a bear so I will just link to [the gist](https://gist.github.com/jmreicha/d299f7b98138d732535bd794ce59afee).

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 25, 2016, 4:48pm UTC](https://discuss.elastic.co/t/logstash-adding-extra-comma-to-tags/58863/6 "2016-08-25T16:48:15Z")

</div>

Indeed, nothing obvious. You could of course just remove the empty tag at the end.

---

<div class="post-metadata">

**Author:** ![Josh\_Reichardt](https://avatars.discourse-cdn.com/v4/letter/j/f08c70/32.png) [@Josh\_Reichardt](https://discuss.elastic.co/u/Josh_Reichardt)\
**Post date:** [August 25, 2016, 5:09pm UTC](https://discuss.elastic.co/t/logstash-adding-extra-comma-to-tags/58863/7 "2016-08-25T17:09:44Z")

</div>

Do you have a good example of how to do that (remove empty tags)?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 25, 2016, 6:08pm UTC](https://discuss.elastic.co/t/logstash-adding-extra-comma-to-tags/58863/8 "2016-08-25T18:08:19Z")

</div>

Try the `remove_tag` option of any filter (or a standalone mutate filter).

---

<div class="post-metadata">

**Author:** ![Josh\_Reichardt](https://avatars.discourse-cdn.com/v4/letter/j/f08c70/32.png) [@Josh\_Reichardt](https://discuss.elastic.co/u/Josh_Reichardt)\
**Post date:** [August 25, 2016, 6:09pm UTC](https://discuss.elastic.co/t/logstash-adding-extra-comma-to-tags/58863/9 "2016-08-25T18:09:04Z")

</div>

I'll give it a shot. Thanks!

---

<div class="post-metadata">

**Author:** ![Josh\_Reichardt](https://avatars.discourse-cdn.com/v4/letter/j/f08c70/32.png) [@Josh\_Reichardt](https://discuss.elastic.co/u/Josh_Reichardt)\
**Post date:** [August 25, 2016, 7:01pm UTC](https://discuss.elastic.co/t/logstash-adding-extra-comma-to-tags/58863/10 "2016-08-25T19:01:37Z")

</div>

For anybody else, the following pattern works.

```auto
filter
...

mutate {
    remove_tag => ["tags", ""]
}

...

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:41am UTC](https://discuss.elastic.co/t/logstash-adding-extra-comma-to-tags/58863/11 "2017-07-06T04:41:33Z")

</div>