# Not able to write in file with particular tag

**URL:** <https://discuss.elastic.co/t/not-able-to-write-in-file-with-particular-tag/214440>\
**Category:** Logstash\
**Created:** [January 9, 2020, 1:58pm UTC](https://discuss.elastic.co/t/not-able-to-write-in-file-with-particular-tag/214440 "2020-01-09T13:58:11Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![srbhklkrn](https://avatars.discourse-cdn.com/v4/letter/s/e480ec/32.png) [@srbhklkrn](https://discuss.elastic.co/u/srbhklkrn)\
**Post date:** [January 9, 2020, 1:58pm UTC](https://discuss.elastic.co/t/not-able-to-write-in-file-with-particular-tag/214440/1 "2020-01-09T13:58:11Z")

</div>

I'm trying to write all logs with tag `Prod` to file but it's not working. When I remove tag condition it works but not with tags.

Any inputs?

Here is my pipeline:

```
   input {
  tcp {
    port => 10514
    type => syslog
  }

  udp {
    port => 10514
    type => syslog
  }

}

filter {
  if [type] == "syslog" {
    grok {
      match => { "message" => "%{SYSLOG5424PRI}%{NONNEGINT:syslog5424_ver} +(?:%{TIMESTAMP_ISO8601:syslog5424_ts}|-) +(?:%{HOSTNAME:syslog5424_host}|-) +(?:%{NOTSPACE:syslog5424_app}|-) +(?:%{NOTSS
PACE:syslog5424_proc}|-) +(?:%{WORD:syslog5424_msgid}|-) +(?:%{SYSLOG5424SD:syslog5424_sd}|-|) +%{GREEDYDATA:syslog5424_msg}" }
    }

    syslog_pri { }

    date {
      match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
    }

    if !("_grokparsefailure" in [tags]) {
      mutate {
        replace => ["@source_host", "%{syslog_hostname}"]
        replace => ["@message", "%{syslog_message}"]
      }
    }

    mutate {
      remove_field => ["syslog_hostname", "syslog_message", "syslog_timestamp"]
    }

    if [message] =~ /.prod./ {
        mutate {
                add_tag => ["Prod"]
        }
     }
  }

}

output {
  if [type] == "syslog" {
    elasticsearch {
      hosts => ["10.31.45.85:9450", "10.31.45.86:9450", "10.31.45.87:9450"]
      index => "logstash-%{+yyyy.MM.dd}"
    }

    if "Prod" in [tags] {

      file {
        path => "/home/myuser/logstash-logs/test-%{+YYYY-MM-dd}.log"
        codec => rubydebug
      }
    } else {
      file {
        path => "/home/myuser/logstash-logs/test2-%{+YYYY-MM-dd}.log"
        codec => rubydebug
      }
    }
  }
}
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 9, 2020, 3:48pm UTC](https://discuss.elastic.co/t/not-able-to-write-in-file-with-particular-tag/214440/2 "2020-01-09T15:48:52Z")

</div>

Are you saying that when you use the 'if "Prod" in [tags] {' conditional the events do not get written to either file?

---

<div class="post-metadata">

**Author:** ![srbhklkrn](https://avatars.discourse-cdn.com/v4/letter/s/e480ec/32.png) [@srbhklkrn](https://discuss.elastic.co/u/srbhklkrn)\
**Post date:** [January 9, 2020, 3:51pm UTC](https://discuss.elastic.co/t/not-able-to-write-in-file-with-particular-tag/214440/3 "2020-01-09T15:51:10Z")

</div>

it gets written in else part but not in if part

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 9, 2020, 4:46pm UTC](https://discuss.elastic.co/t/not-able-to-write-in-file-with-particular-tag/214440/4 "2020-01-09T16:46:40Z")

</div>

Then the [tags] array does not contain an entry "Prod". What does the event look like in kibana? Copy and paste from the JSON tab after expanding an event.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 6, 2020, 4:55pm UTC](https://discuss.elastic.co/t/not-able-to-write-in-file-with-particular-tag/214440/5 "2020-02-06T16:55:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.