# Tagging incoming logs based on source **URL:** \ **Category:** Logstash\ **Created:** [March 16, 2017, 7:20pm UTC](https://discuss.elastic.co/t/tagging-incoming-logs-based-on-source/78921 "2017-03-16T19:20:08Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![cisaksen](https://avatars.discourse-cdn.com/v4/letter/c/49beb7/32.png) [@cisaksen](https://discuss.elastic.co/u/cisaksen)\ **Post date:** [March 16, 2017, 7:20pm UTC](https://discuss.elastic.co/t/tagging-incoming-logs-based-on-source/78921/1 "2017-03-16T19:20:08Z")
4 Web servers - 3 are production and 1 is a test server. All 4 are sending multiple logs to logstash via filebeats. All are using the same log format. What is the best way to tag each log record as they are processed ? I want to add multiple tags to log records based on 2 different attributes, 1) Product vs Test 2) which server sent the log. In the case of production to see if there is any anomalies between the servers. Is this possible in this setup ? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 17, 2017, 7:30am UTC](https://discuss.elastic.co/t/tagging-incoming-logs-based-on-source/78921/2 "2017-03-17T07:30:26Z")
> I want to add multiple tags to log records based on 2 different attributes, 1) Product vs Test Use Filebeat's `fields` option to add a field that indicates whether the log is on a production or test system. Or you can add a tag instead of a field, that's up to you. > 1. which server sent the log. In the case of production to see if there is any anomalies between the servers. There should already be a field with the hostname of the sending server. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 14, 2017, 7:30am UTC](https://discuss.elastic.co/t/tagging-incoming-logs-based-on-source/78921/3 "2017-04-14T07:30:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.