# Remove all tags at one time?
**URL:** https://discuss.elastic.co/t/remove-all-tags-at-one-time/373931
**Category:** Logstash
**Created:** [January 31, 2025, 10:24am UTC](https://discuss.elastic.co/t/remove-all-tags-at-one-time/373931 "2025-01-31T10:24:46Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@sbocquet](https://discuss.elastic.co/u/sbocquet)
#### Post date: [January 31, 2025, 10:24am UTC](https://discuss.elastic.co/t/remove-all-tags-at-one-time/373931/1 "2025-01-31T10:24:46Z")
Hi,
Is it possible to remove all tags in the [tags] field at one time ?
I have this filter :
```auto
# Transfert junk to the garbage datastream
if [Severity] == "DEBUG" {
mutate {
update => { "[data_stream][dataset]" => "garbage" }
remove_tag => [
"_grok_windows_success",
"_grok_windows_nomatch",
"_grok_IIS_success",
"_grok_IIS_nomatch",
"_grok_apache_success",
"_grok_apache_nomatch"
]
add_tag => ["_grok_garbage_debug_success"]
}
}
```
I have tried to replace all the values with :
```auto
mutate {
replace => { "tags" => [] }
}
```
but the result is that the tags field have "" in it !
Any advice how I can do it ?
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [January 31, 2025, 12:21pm UTC](https://discuss.elastic.co/t/remove-all-tags-at-one-time/373931/2 "2025-01-31T12:21:28Z")
If you want to remove all tags, you can just remove the entire field.
```auto
mutate {
remove_field => ["tags"]
}
```
---
### Author:  [@sbocquet](https://discuss.elastic.co/u/sbocquet)
#### Post date: [January 31, 2025, 12:34pm UTC](https://discuss.elastic.co/t/remove-all-tags-at-one-time/373931/3 "2025-01-31T12:34:08Z")
Hi,
Thanks for your answer.
The fact is that I want to keep the "tags" field to put another tag in it after cleaning... as in the example above.
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [January 31, 2025, 1:15pm UTC](https://discuss.elastic.co/t/remove-all-tags-at-one-time/373931/4 "2025-01-31T13:15:30Z")
You can use something like this:
```auto
if [Severity] == "DEBUG" {
mutate {
update => { "[data_stream][dataset]" => "garbage" }
remove_field => ["tags"]
}
mutate {
add_tag => ["_grok_garbage_debug_success"]
}
}
```
This way the first mutate remove the field and the second add the tag.
You cannot do both in the same mutate because the sequence of operation needs to be preserved, and in this case you need different mutate blocks.
---
### Author:  [@sbocquet](https://discuss.elastic.co/u/sbocquet)
#### Post date: [January 31, 2025, 1:31pm UTC](https://discuss.elastic.co/t/remove-all-tags-at-one-time/373931/5 "2025-01-31T13:31:02Z")
Thanks for the tip 😉
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [January 31, 2025, 1:33pm UTC](https://discuss.elastic.co/t/remove-all-tags-at-one-time/373931/6 "2025-01-31T13:33:03Z")
Also you have possibility custom tags:
- tag\_on\_failure - Default value is ["\_grokparsefailure"]
- tag\_on\_timeout - Default value is "\_groktimeout"
Just add in the grok structure.