Please help, I cannot add two tags without replacing the tag that added first

Elastic Stack Logstash
1

I have tried the following code but it does not work.

  event.set("[tags]", event.get("[tags]").push("PSY")) if event.get("[NAME]") != "ALPHA"
  event.set("[tags]", event.get("[tags]").push("OUR")) if event.get("[NAME]") == "DTD"

If I use the + sign - it appends the new tag with the old tag to make it -- "DeltaPSY"

how should I handle when the "tags" field has null value. I think thats the problem. Please help

I want to add multiple tags based on specific value of different fields. I have tried using the add_tags functionality but that also replaces the old tags.

2

Don't modify the tags field directly, use the event.tag method (event.tag('PSY') etc).

3

Perfect! thank you very much . There isnt any documentation on the Event API page about this function :slight_smile:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.