# Tags are not seen in indexer

**URL:** <https://discuss.elastic.co/t/tags-are-not-seen-in-indexer/231977>\
**Category:** Logstash\
**Created:** [May 11, 2020, 10:09am UTC](https://discuss.elastic.co/t/tags-are-not-seen-in-indexer/231977 "2020-05-11T10:09:40Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Djamox](https://avatars.discourse-cdn.com/v4/letter/d/ce7236/32.png) [@Djamox](https://discuss.elastic.co/u/Djamox)\
**Post date:** [May 11, 2020, 10:09am UTC](https://discuss.elastic.co/t/tags-are-not-seen-in-indexer/231977/1 "2020-05-11T10:09:41Z")

</div>

Hello,

I have a configuration like this :  
Logs -\> Logstash Broker -\> Kafka -\> Logstash Indexer -\> Elasticsearch

In the borker, I add a tag "waf" to identify the log source.  
In the indexer, I use this condition in the filters :

```
if "waf" in [tags] {
  mutate {
    add_tag => ["if"]
}
else {
  mutate {
    add_tag => ["else"]
}

```

In Kibana, I can see the tag "waf" but the indexer doesn't seem to see it, because the tag "else" is added (not the tag"if").

Thanks for any help.  
Max

---

<div class="post-metadata">

**Author:** ![Djamox](https://avatars.discourse-cdn.com/v4/letter/d/ce7236/32.png) [@Djamox](https://discuss.elastic.co/u/Djamox)\
**Post date:** [May 11, 2020, 12:25pm UTC](https://discuss.elastic.co/t/tags-are-not-seen-in-indexer/231977/2 "2020-05-11T12:25:38Z")

</div>

Ok I found the solution : I need to add the json filter before the condition.

```
json { source => "message" }
if "waf" in [tags] {
  mutate {
    add_tag => ["if"]
}
else {
  mutate {
    add_tag => ["else"]
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 8, 2020, 12:25pm UTC](https://discuss.elastic.co/t/tags-are-not-seen-in-indexer/231977/3 "2020-06-08T12:25:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.