More than a tag on an INPUT? Is it possible?

[canob]

Hi everyone,

A simple question that I didn't find in the documentation: is it possible to set more than a tag on an INPUT?

For example:

[INPUT]
    Name tail
    Tag windows, dns
    Path C:/Logs/DNS.json
    Parser dns_parsers
    Mem_Buf_Limit 7MB
    Refresh_Interval 10

Because I'm not receiving any error in the logs, but it is not working.

Thanks in advance for your help.

[patrick-stephens]

My guess is you're getting the single tag windows, dns but it's not clear what you mean by "it is not working" - I guess you mean trying to match on either windows or dns but that's because it is a single tag not two?

Typically I would use wildcards for this with tags following a structure like a.b.c then you can match on a.b.* or *.c.

Otherwise you would need a rewrite_tag filter or similar to provide a new record with a different tag to match on.

[canob]

Hi @patrick-stephens,

Yes, I mean with "it is not working" that I expected to get two tags, windows and dns, for the same record.
For example, the idea is to have for the same record one tag for os (windows) and one tag for technology (dns), using tagging like categorization, and use that to route to different outputs.

[patrick-stephens]

Sure, I don't think you can have multiple tags for one record.

The idea is to either use a regex or wildcard to the routing you want, e.g. <os>.* and *.<tech> (more complex options are available particularly with regex but this example would do what you asked) or use rewrite_tag to create you a duplicate record with a different tag.