# Tagging events with extracts from grok patterns

**URL:** <https://discuss.elastic.co/t/tagging-events-with-extracts-from-grok-patterns/296004>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 1, 2022, 9:11pm UTC](https://discuss.elastic.co/t/tagging-events-with-extracts-from-grok-patterns/296004 "2022-02-01T21:11:19Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![zach\_trio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zach_trio/32/96990_2.png) [@zach\_trio](https://discuss.elastic.co/u/zach_trio)\
**Post date:** [February 1, 2022, 9:11pm UTC](https://discuss.elastic.co/t/tagging-events-with-extracts-from-grok-patterns/296004/1 "2022-02-01T21:11:19Z")

</div>

Hi all,

I am using Filebeat to pass logs to Logstash for parsing and ingestion into Elasticsearch. Take this config extract for example:

```auto
filebeat.inputs:
- type: filestream
  paths:
  - /opt/containers/sites/*/html/var/log/system.log
  - /opt/containers/sites/*/html/var/log/debug.log
  - /opt/containers/sites/*/html/var/log/exception.log

  tags: ["magento"]

```

As you can see, I am grabbing all of my Magento logs. The problem arises when I want to filter logs by site in Kibana. At this point I can't see a very obvious or easy way to do this. I thought it would be great if I could add tags depending on what grok finds, e.g. grok finds a file at

```auto
/opt/containers/sites/examplemagentostore.com/html/var/log/system.log

```

and tags events with _magento-examplemagentostore_. I am trying to avoid hard coding the sites into Filebeat's config as that wouldn't be very dynamic with adding more sites.

Any thoughts or resources are appreciated.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 1, 2022, 11:11pm UTC](https://discuss.elastic.co/t/tagging-events-with-extracts-from-grok-patterns/296004/2 "2022-03-01T23:11:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.