# Pipelines, JSON, array for tags

**URL:** <https://community.graylog.org/t/pipelines-json-array-for-tags/27603>\
**Category:** Graylog Central (peer support)\
**Created:** [February 6, 2023, 3:45pm UTC](https://community.graylog.org/t/pipelines-json-array-for-tags/27603 "2023-02-06T15:45:15Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [February 10, 2023, 1:09am UTC](https://community.graylog.org/t/pipelines-json-array-for-tags/27603/4 "2023-02-10T01:09:06Z")

</div>

Hello @benoitp

> [@benoitp](#):
>
> trying to replicate a Beat input behavior for tags with Pipelines and “flatten\_json”

Your using Filebeat. Correct me if im wrong, filebeat currently only sends JSON documents.

But the Pipeline shows, and again correct me if im wrong you trying to get the **Message** field and flatten it out when I believe you are already sending it in json format. In this case I would suggest when useing Filebeat then use the Beat input.

Here is a good Example:

> [@Rsyslog app name](https://community.graylog.org/t/rsyslog-app-name/27053/4):
>
> This is just the auth collector configuration you can add multiple log files into one collector - if you need more help with setting up filebeats, start a new thread… smiley # Needed for Graylog fields\_under\_root: true fields.collector\_node\_id: ${sidecar.nodeName} fields.gl2\_source\_collector: ${sidecar.nodeId} filebeat.inputs: - type: filestream id: id-linux-auth enabled: true paths: - /var/log/auth.log tags: - linux logging.metrics.enabled: false fields: os\_ver: u…

---

_[View the full topic](https://community.graylog.org/t/pipelines-json-array-for-tags/27603)._