# Tags in logstash
**URL:** https://discuss.elastic.co/t/tags-in-logstash/203782
**Category:** Logstash
**Created:** [October 16, 2019, 8:37am UTC](https://discuss.elastic.co/t/tags-in-logstash/203782 "2019-10-16T08:37:05Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@beren](https://discuss.elastic.co/u/beren)
#### Post date: [October 16, 2019, 8:37am UTC](https://discuss.elastic.co/t/tags-in-logstash/203782/1 "2019-10-16T08:37:06Z")
Hi
How to direct postfix logs to index postfix ?
In logstash config
```auto
input {
beats {
port => 5044
}
}
filter {
grok {
}
}
output {
if "postfix" in [tags]{
elasticsearch {
hosts => "localhost:9200"
index => "postfix-%{+YYYY.MM.dd}"
}
}
}
```
In filebeat
```auto
filebeat.inputs:
- type: log
enabled: true
paths:
- /var/log/maillog*
exclude_files: [".gz$"]
tags: ["postfix"]
output.logstash:
hosts: ["10.50.11.8:5044"]
```
In the log logstash a lot
```auto
[2019-10-15T15:48:42,437][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"newrelicdata", :_type=>"_doc", :routing=>nil}, #], :response=>{"index"=>{"_index"=>"newrelicdata", "_type"=>"_doc", "_id"=>"V7x2z20Bp3jq-MOqpNbt", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [host] of type [text] in document with id 'V7x2z20Bp3jq-MOqpNbt'. Preview of field's value: '{name=mail.domain.com}'", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:521"}}}}}
```
Why date from [mail.domain.com](http://mail.domain.com) try to get not in index postfix ? And the data is trying to get into all the indexes ? Any help
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 13, 2019, 8:37am UTC](https://discuss.elastic.co/t/tags-in-logstash/203782/2 "2019-11-13T08:37:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.