# Obtaining Tags from Tags
**URL:** https://discuss.elastic.co/t/obtaining-tags-from-tags/31531
**Category:** Logstash
**Created:** [October 2, 2015, 8:34am UTC](https://discuss.elastic.co/t/obtaining-tags-from-tags/31531 "2015-10-02T08:34:43Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@billy6](https://discuss.elastic.co/u/billy6)
#### Post date: [October 2, 2015, 8:34am UTC](https://discuss.elastic.co/t/obtaining-tags-from-tags/31531/1 "2015-10-02T08:34:43Z")
Hello, I would like to Slipt a Tag in several parts. I mean, I have the Tag "Comment" = "[Module12] Statblablabla" I would like to divide it in other two Tags "Module" = Module12 and "Status" = Statblablabla. But with the Tag "Coment" preserved, I mean, at the end I would have 3 Tags.
This is the line in my patterns file:
COMMENT\_MESSAGE (?m) [%{GREEDYDATA:Module}]\ %{GREEDYDATA:Status}
And I have tried
match =\> [
"Comment", "%{COMMENT\_MESSAGE}"
]
What am I doing wrong? Because I only get Comment Tag, but not the other two.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 2, 2015, 9:19am UTC](https://discuss.elastic.co/t/obtaining-tags-from-tags/31531/2 "2015-10-02T09:19:46Z")
You didn't format the pattern file line as code so things were probably stripped away, but the problem is probably the space before the opening square bracket. This works:
```
(?m)\[%{GREEDYDATA:Module}\] %{GREEDYDATA:Status}
```
---
### Author:  [@billy6](https://discuss.elastic.co/u/billy6)
#### Post date: [October 2, 2015, 1:44pm UTC](https://discuss.elastic.co/t/obtaining-tags-from-tags/31531/3 "2015-10-02T13:44:52Z")
I have tried it, but without success. I have the same problem, in Kibana I dont get these new Tags.
This is my grok filter
```
grok {
patterns_dir => "/etc/logstash/patterns"
match => [
"message","%{MESSAGE_1}",
"message", "%{MESSAGE_2}",
"Comment","%{COMMENT_MESSAGE}"
]
}
```
And in my patterns file I have\>
```
MESSAGE_1 (?m)%{DATE} \[%{LOGLEVEL:log_level}\] \<%{ERRORCODE:error_code}\> -> %{GREEDYDATA:Comment}
MESSAGE_2 (?m)%{DATE} \[%{APPNAME:app_name}\] \[%{LOGLEVEL:log_level}\] \<%{ERRORCODE:error_code}\> -> %{GREEDYDATA:Comment}
COMMENT_MESSAGE (?m)\[%{GREEDYDATA:Module}\] %{GREEDYDATA:ModuleComment}
```
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 2, 2015, 2:00pm UTC](https://discuss.elastic.co/t/obtaining-tags-from-tags/31531/4 "2015-10-02T14:00:19Z")
See the solution offered in this thread from yesterday:
> [@How to extract an Information from an attribute?](https://discuss.elastic.co/t/how-to-extract-an-information-from-an-attribute/31446):
>
> Hello elastic community, I have a problem with one of my Logstash parsing configurations. One customer want to use a country field. The information to fill the country field I can extract from the path, but I don't know exactly how to do this. All my tries weren't successfull to realize it. my Code look like: input { file { path =\> ["/was/log//1/mip/vn/1/server.log"] type =\> "serverlog" codec =\> multiline { pattern =\> "^%{TIME}" …
---
### Author:  [@billy6](https://discuss.elastic.co/u/billy6)
#### Post date: [October 2, 2015, 2:49pm UTC](https://discuss.elastic.co/t/obtaining-tags-from-tags/31531/5 "2015-10-02T14:49:14Z")
So the grok filters have to be separated, I have tried this but it doesn't work...
```
grok {
patterns_dir => "/etc/logstash/patterns"
match => [
"message","%{MESSAGE_1}",
"message", "%{MESSAGE_2}"
]
}
grok {
patterns_dir => "/etc/logstash/patterns"
match => [
"Comment","%{COMMENT_MESSAGE}"
]
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:27am UTC](https://discuss.elastic.co/t/obtaining-tags-from-tags/31531/6 "2017-07-06T05:27:27Z")