# Multiple indexes multiple tag

**URL:** <https://discuss.elastic.co/t/multiple-indexes-multiple-tag/295229>\
**Category:** Kibana\
**Created:** [January 24, 2022, 12:50pm UTC](https://discuss.elastic.co/t/multiple-indexes-multiple-tag/295229 "2022-01-24T12:50:34Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![graimato](https://avatars.discourse-cdn.com/v4/letter/g/9e8a1a/32.png) [@graimato](https://discuss.elastic.co/u/graimato)\
**Post date:** [January 24, 2022, 12:50pm UTC](https://discuss.elastic.co/t/multiple-indexes-multiple-tag/295229/1 "2022-01-24T12:50:34Z")

</div>

Hello,  
I divide my log in different index using event.module value

```auto
indices:
    - index: "filebeat-system-%{+yyyy.MM.dd}"
      when.equals:
        event.module: "system"
    - index: "filebeat-apache-%{+yyyy.MM.dd}"
      when.equals:
        event.module: "apache"

```

It is possibile at this level apply tags or field?  
example

```auto
indices:
    - index: "filebeat-system-%{+yyyy.MM.dd}"
      when.equals:
        event.module: "system"
      tags: ["system"] 
    - index: "filebeat-apache-%{+yyyy.MM.dd}"
      when.equals:
        event.module: "apache"
      tags: ["apache"]

```

Thanks for your time  
best regards

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [January 25, 2022, 6:21pm UTC](https://discuss.elastic.co/t/multiple-indexes-multiple-tag/295229/2 "2022-01-25T18:21:40Z")

</div>

Hi, I'm not sure how this question ended up under the Kibana topic. What tool uses the configuration that you have provided? I might be able to help, but you can probably get better help from the experts of that tool.

---

<div class="post-metadata">

**Author:** ![graimato](https://avatars.discourse-cdn.com/v4/letter/g/9e8a1a/32.png) [@graimato](https://discuss.elastic.co/u/graimato)\
**Post date:** [January 26, 2022, 6:50am UTC](https://discuss.elastic.co/t/multiple-indexes-multiple-tag/295229/3 "2022-01-26T06:50:49Z")

</div>

Thanks for your time, I'm collecting log using Filebeat and I split data in different index using event.module, I would to apply also a custon tag or/and a field to the log es. tag system for index filebeat-systemXYZ or tag apache for index filebeat-apacheXYZ.

Thanks for your time

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [January 26, 2022, 5:57pm UTC](https://discuss.elastic.co/t/multiple-indexes-multiple-tag/295229/4 "2022-01-26T17:57:05Z")

</div>

Hi, you should look for information about enhancing the data in filebeat before sending it to the output.

I'm not sure if you found the right documentation on defining processors that do this, but you can check here: [Define processors | Filebeat Reference [7.16] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/defining-processors.html)

It looks like the type of processor you'll want to use is `add_fields`: [Add fields | Filebeat Reference [7.16] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/add-fields.html)

If you still get stuck, I recommend moving this question to the Observability \> Logs area: [Logs - Discuss the Elastic Stack](https://discuss.elastic.co/c/observability/logs/69)

---

<div class="post-metadata">

**Author:** ![graimato](https://avatars.discourse-cdn.com/v4/letter/g/9e8a1a/32.png) [@graimato](https://discuss.elastic.co/u/graimato)\
**Post date:** [February 3, 2022, 1:37pm UTC](https://discuss.elastic.co/t/multiple-indexes-multiple-tag/295229/5 "2022-02-03T13:37:28Z")

</div>

Thanks for your Help  
it is a good solution to my problem.

Thanks again  
best regards

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 3, 2022, 1:37pm UTC](https://discuss.elastic.co/t/multiple-indexes-multiple-tag/295229/6 "2022-03-03T13:37:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.