# Tags written to .monitoring-es-8-mb by metricbeat is not searchable

**URL:** https://discuss.elastic.co/t/tags-written-to-monitoring-es-8-mb-by-metricbeat-is-not-searchable/324562
**Category:** Beats
**Tags:** elastic-stack-monitoring, metricbeat
**Created:** [February 2, 2023, 4:07pm UTC](https://discuss.elastic.co/t/tags-written-to-monitoring-es-8-mb-by-metricbeat-is-not-searchable/324562 "2023-02-02T16:07:06Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Abhi\_Abhishek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abhi_abhishek/32/101426_2.png) [@Abhi\_Abhishek](https://discuss.elastic.co/u/Abhi_Abhishek)
#### Post date: [February 2, 2023, 4:07pm UTC](https://discuss.elastic.co/t/tags-written-to-monitoring-es-8-mb-by-metricbeat-is-not-searchable/324562/1 "2023-02-02T16:07:07Z")

</div>

The tags added through processors in metricbeat.yml writes to monitoring-es-8-mb index which shows tags field when searched with only index name.  
Metricbeat.yml config

```auto
processors:
  - add_tags:
      tags: [Earth]
      target: "tags"

```

```auto
GET .monitoring-es-8-mb/_search

```

gives

```auto
{
        "_index": ".ds-.monitoring-es-8-mb-2023.02.02-000001",
        "_id": "Q7mdohkVSO-ZPvOI2Wv3Vg:vCvc1I0mR0exEf8pCdH8Gw:.ds-ilm-history-5-2022.07.07-000001:0:p",
        "_score": 1,
        "_source": {
          "@timestamp": "2023-02-02T15:54:22.727Z",
          **"tags": [**
 **"Earth"**
**],**
          "metricset": {
            "period": 10000,
            "name": "shard"
          },
          "service": {
            "address": "http://localhost:9200",
            "type": "elasticsearch"
          },
          "elasticsearch": {
            "shard": {
              "relocating_node": {},
              "state": "STARTED",
              "primary": true,
              "source_node": {
                "uuid": "vCvc1I0mR0exEf8pCdH8Gw",
                "name": "LIN80024256"
              },
              "number": 0
            },
            "cluster": {
              "state": {
                "id": "Q7mdohkVSO-ZPvOI2Wv3Vg"
              },
              "stats": {
                "state": {
                  "state_uuid": "Q7mdohkVSO-ZPvOI2Wv3Vg"
                }
              },
              "id": "eHOPW-2ITs-WrFtx15BaHg",
              "name": "elasticsearch"
            },
            "node": {
              "id": "vCvc1I0mR0exEf8pCdH8Gw",
              "name": "LIN80024256"
            },
            "index": {
              "name": ".ds-ilm-history-5-2022.07.07-000001"
            }
          },
          "event": {
            "duration": 7798100,
            "dataset": "elasticsearch.shard",
            "module": "elasticsearch"
          },
          "ecs": {
            "version": "8.0.0"
          },
          "host": {
            "hostname": "LIN80024256",
            "architecture": "x86_64",
            "os": {
              "build": "22000.1455",
              "type": "windows",
              "platform": "windows",
              "version": "10.0",
              "family": "windows",
              "name": "Windows 10 Pro",
              "kernel": "10.0.22000.1455 (WinBuild.160101.0800)"
            },
            "id": "76c8f942-b7a2-4de8-bd0a-7146780917c2",
            "ip": [
              "169.254.81.199",
              "169.254.81.182",
              "169.254.63.129",
              "192.168.40.67"
            ],
            "mac": [
              "14:cb:19:bc:26:62",
              "d0:3c:1f:13:c0:45",
              "d0:3c:1f:13:c0:46",
              "d2:3c:1f:13:c0:45"
            ],
            "name": "LIN80024256"
          },
          "agent": {
            "id": "42c6c88f-fa85-44b4-bf7b-6ce08ce8542c",
            "name": "LIN80024256",
            "type": "metricbeat",
            "version": "8.3.1",
            "ephemeral_id": "177261c5-04dc-4e9c-b833-89b211dfe16e"
          }
        }
      },

```

But when searched with the following queries its shows NIL

```auto
GET .monitoring-es-8-mb*/_search
{
  "query": {
    "exists": {
      "field": "tags"
    }
  }
}

```

```auto
GET .monitoring-es-8-mb*/_search
{
  "query": {
   "match": {
     "tags": "Earth"
   }
  }
}

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 2, 2023, 6:07pm UTC](https://discuss.elastic.co/t/tags-written-to-monitoring-es-8-mb-by-metricbeat-is-not-searchable/324562/2 "2023-03-02T18:07:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.