# Using cidr plugin for tagging logs

**URL:** <https://discuss.elastic.co/t/using-cidr-plugin-for-tagging-logs/72878>\
**Category:** Logstash\
**Created:** [January 26, 2017, 10:18am UTC](https://discuss.elastic.co/t/using-cidr-plugin-for-tagging-logs/72878 "2017-01-26T10:18:08Z")\
**Posts on this page:** 1\
**Showing post:** 16

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 27, 2017, 3:13pm UTC](https://discuss.elastic.co/t/using-cidr-plugin-for-tagging-logs/72878/16 "2017-01-27T15:13:02Z")

</div>

> If I understand, it try to interprat "%{host}" as a hostname ?

It tries to expand `%{host}` into the contents of the `host` field, but the event in question apparently doesn't have such a field so it leaves the string alone.

---

_[View the full topic](https://discuss.elastic.co/t/using-cidr-plugin-for-tagging-logs/72878)._