title: Tags index with filebeat and logstash
body: <p>I use logstash-forwarder and logstash and create a dynamic index with tags with this configuration:</p>
  
  <p>/etc/logstash/conf.d/10-output.conf</p>
  
  <pre><code>output {
    elasticsearch {
      hosts =&gt; "localhost:9200"
      manage_template =&gt; false
      index =&gt; "logstash-%{tags}-%{+YYYY.MM.dd}"
    }
  }
  </code></pre>
  
  <p>/etc/logstash-forwarder.conf</p>
  
  <pre><code>"files": [
      {
        "paths": [
          "/var/log/httpd/ssl_access_log",
          "/var/log/httpd/ssl_error_log"
         ],
        "fields": { "type": "apache", "tags": "mytag" }
      },
  </code></pre>
  
  <p>The associated filebeat configuration is:</p>
  
  <p>/etc/filebeat/filebeat.yml</p>
  
  <pre><code>filebeat:
    prospectors:
      -
       paths:
         - /var/log/httpd/access_log
       input_type: log
       document_type: apache
       fields:
         tags: mytag
  </code></pre>
  
  <p>In Kibana, instead of <code>mytag</code> I see <code>beats_input_codec_plain_applied</code> on all of my indices.</p>