# Tags vs Fields for conditional search

**URL:** https://discuss.elastic.co/t/tags-vs-fields-for-conditional-search/85912
**Category:** Logstash
**Created:** [May 16, 2017, 11:05am UTC](https://discuss.elastic.co/t/tags-vs-fields-for-conditional-search/85912 "2017-05-16T11:05:04Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![sahar\_q](https://avatars.discourse-cdn.com/v4/letter/s/dbc845/32.png) [@sahar\_q](https://discuss.elastic.co/u/sahar_q)
#### Post date: [May 16, 2017, 11:05am UTC](https://discuss.elastic.co/t/tags-vs-fields-for-conditional-search/85912/1 "2017-05-16T11:05:04Z")

</div>

Which way is more efficient for conditional searching?  
i know little of the implementation but according to my way of thinking Tags should be better is that correct?  
If so i'd like to know the implementation difference that makes it so

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [May 16, 2017, 11:06am UTC](https://discuss.elastic.co/t/tags-vs-fields-for-conditional-search/85912/2 "2017-05-16T11:06:44Z")

</div>

Searching what where?

---

<div class="post-metadata">

### Author: ![sahar\_q](https://avatars.discourse-cdn.com/v4/letter/s/dbc845/32.png) [@sahar\_q](https://discuss.elastic.co/u/sahar_q)
#### Post date: [May 16, 2017, 11:09am UTC](https://discuss.elastic.co/t/tags-vs-fields-for-conditional-search/85912/3 "2017-05-16T11:09:05Z")

</div>

Conditional search in elasticsearch, using Tags and fields.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 16, 2017, 11:48am UTC](https://discuss.elastic.co/t/tags-vs-fields-for-conditional-search/85912/4 "2017-05-16T11:48:32Z")

</div>

Please be explicit and give examples of both of the things you're talking about.

---

<div class="post-metadata">

### Author: ![sahar\_q](https://avatars.discourse-cdn.com/v4/letter/s/dbc845/32.png) [@sahar\_q](https://discuss.elastic.co/u/sahar_q)
#### Post date: [May 16, 2017, 12:15pm UTC](https://discuss.elastic.co/t/tags-vs-fields-for-conditional-search/85912/5 "2017-05-16T12:15:46Z")

</div>

Say i am adding arp table data where each document is a line from that table:  
"192.168.0.1","255.255.255.255","ff-ff-ff-ff-ff-ff","static"  
each of the value in the line above will be fields.

say i want to add an identifier which will contain a machines name or ip as [**Field OR Tag**]  
so i could make a query that will show me where on a specific machine there are duplicate fields values.

so my question is, what is more efficient, adding the identifier as tag or field,  
thanks

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [May 16, 2017, 9:05pm UTC](https://discuss.elastic.co/t/tags-vs-fields-for-conditional-search/85912/6 "2017-05-16T21:05:49Z")

</div>

> [@sahar\_q](#):
>
> so my question is, what is more efficient, adding the identifier as tag or field,

Either is the same thing to LS.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 13, 2017, 9:06pm UTC](https://discuss.elastic.co/t/tags-vs-fields-for-conditional-search/85912/7 "2017-06-13T21:06:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
