# Tag input name file

**URL:** <https://discuss.elastic.co/t/tag-input-name-file/130308>\
**Category:** Logstash\
**Created:** [May 2, 2018, 5:56pm UTC](https://discuss.elastic.co/t/tag-input-name-file/130308 "2018-05-02T17:56:18Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![elk2](https://avatars.discourse-cdn.com/v4/letter/e/f14d63/32.png) [@elk2](https://discuss.elastic.co/u/elk2)\
**Post date:** [May 2, 2018, 5:56pm UTC](https://discuss.elastic.co/t/tag-input-name-file/130308/1 "2018-05-02T17:56:18Z")

</div>

It 's possible to tag multiple input file name ?  
I have many txt file and I want to tag all file maybe with name file if it's possible.

```
input {
   file {
    path => "/var/log/testing/*.txt"
    start_position => "beginning"
    sincedb_path => "/dev/null"
    ignore_older => "0"
    tags => ["events"]
  }
}
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 2, 2018, 6:42pm UTC](https://discuss.elastic.co/t/tag-input-name-file/130308/2 "2018-05-02T18:42:24Z")

</div>

Logstash already adds a field with the path to the input file from which the event was read.

---

<div class="post-metadata">

**Author:** ![elk2](https://avatars.discourse-cdn.com/v4/letter/e/f14d63/32.png) [@elk2](https://discuss.elastic.co/u/elk2)\
**Post date:** [May 3, 2018, 10:51am UTC](https://discuss.elastic.co/t/tag-input-name-file/130308/3 "2018-05-03T10:51:45Z")

</div>

Thanks Magnusbaeck. I solved with this logstash conf.

```
input {
   file {
    path => "/var/log/testing/*.txt"
    start_position => "beginning"
    sincedb_path => "/dev/null"
    ignore_older => "0"
    tags => ["events"]
  }
}
    filter {
     
      if "events" in [tags]{
       grok {
          match => { "path" => "%{UNIXPATH:path_tag}/%{GREEDYDATA:namefile_tag}\.txt\.*" }
        }
       mutate {
        add_tag => ["%{namefile_tag}"]
       }  
     }

 output {
      stdout {}
      
      file {
            path => "/var/log/logstash/tagged_stdout.log"
      }
 }

```

Now ,I have some \_groktimeout tag on tags. Maybe is wrong the grok parser.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 3, 2018, 11:04am UTC](https://discuss.elastic.co/t/tag-input-name-file/130308/4 "2018-05-03T11:04:48Z")

</div>

Don't use UNIXPATH. There was a recent thread about this not 24 hours ago.

---

<div class="post-metadata">

**Author:** ![elk2](https://avatars.discourse-cdn.com/v4/letter/e/f14d63/32.png) [@elk2](https://discuss.elastic.co/u/elk2)\
**Post date:** [May 4, 2018, 7:39am UTC](https://discuss.elastic.co/t/tag-input-name-file/130308/5 "2018-05-04T07:39:00Z")

</div>

Thanks! I solved.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 1, 2018, 7:50am UTC](https://discuss.elastic.co/t/tag-input-name-file/130308/6 "2018-06-01T07:50:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.