# Tags vs Fields

**URL:** https://discuss.elastic.co/t/tags-vs-fields/24014
**Category:** Logstash
**Created:** [June 19, 2015, 7:48pm UTC](https://discuss.elastic.co/t/tags-vs-fields/24014 "2015-06-19T19:48:14Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![michaellizhou](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michaellizhou/32/4143_2.png) [@michaellizhou](https://discuss.elastic.co/u/michaellizhou)
#### Post date: [June 19, 2015, 7:48pm UTC](https://discuss.elastic.co/t/tags-vs-fields/24014/1 "2015-06-19T19:48:14Z")

</div>

Here is a simple question yet I do not know the difference: what is the difference between a tag and a field?

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [June 20, 2015, 3:49am UTC](https://discuss.elastic.co/t/tags-vs-fields/24014/2 "2015-06-20T03:49:49Z")

</div>

A field is a subset of the event/document.

A tag is an attribute you can apply to either do conditional based filter on, or to make it easier for searching.

---

<div class="post-metadata">

### Author: ![michaellizhou](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michaellizhou/32/4143_2.png) [@michaellizhou](https://discuss.elastic.co/u/michaellizhou)
#### Post date: [June 22, 2015, 1:53pm UTC](https://discuss.elastic.co/t/tags-vs-fields/24014/3 "2015-06-22T13:53:39Z")

</div>

Still confused probably both can be used to quickly query for a specific attribute. Does this mean I should only add fields when I do not need to do conditionals in my filter? Otherwise if i just need to quickly search I can do it through a field? Or if my purpose is to find an event, on say kibana, I should use a field or tag? Thanks

Mike

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 22, 2015, 2:17pm UTC](https://discuss.elastic.co/t/tags-vs-fields/24014/4 "2015-06-22T14:17:46Z")

</div>

> Still confused probably both can be used to quickly query for a specific attribute.

Yes.

> Does this mean I should only add fields when I do not need to do conditionals in my filter? Otherwise if i just need to quickly search I can do it through a field? Or if my purpose is to find an event, on say kibana, I should use a field or tag?

Either way, really. Tags are a way of attaching boolean values to events, i.e.

```
{
  "tags": [
    "foo",
    "bar"
  ]
}

```

isn't much different from this:

```
{
  "foo": true,
  "bar": true
}

```

Apart from the obvious difference in syntax there's another thing: In the latter case a new "tag value" created as a field will affect the mapping of the type but adding a new string to the `tags` list (which is just a regular Logstash field) won't.

In the end a tag is just a special-purpose field used as a shorthand for slapping, well, a tag onto a document.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:36am UTC](https://discuss.elastic.co/t/tags-vs-fields/24014/5 "2017-07-06T05:36:52Z")

</div>


