Hi Radu,

As Bazsi explained, there is currently no array implementation in syslog-ng,
but you can naturally add as many tags to a message as you want.

Now, when including the TAGS macro in a `format-json` statement, you will
end up with a coma-separated field containing all tags.

As it happens, if sent to Elasticsearch, this field will be indexed by
default using a field of type 'string' and the standard 'analyzer'. This
basically means you will be able to search your documents naturally by tag.

So yes, out of the box, you don't need to do anything, just make sure the
TAGS macro is being sent to ES.

If you want to handle space-separated tags or be case-sensitive, you could
define a custom ES analyzer to only tokenize at the comas, etc.

Cheers

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq