# Parse tag to create new field (wirthout removing the actual tag) **URL:** \ **Category:** Systems\ **Tags:** telegraf\ **Created:** [January 14, 2024, 6:02pm UTC](https://community.influxdata.com/t/parse-tag-to-create-new-field-wirthout-removing-the-actual-tag/32802 "2024-01-14T18:02:34Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![tonic8](https://avatars.discourse-cdn.com/v4/letter/t/6de8d8/32.png) [@tonic8](https://community.influxdata.com/u/tonic8)\ **Post date:** [January 14, 2024, 6:02pm UTC](https://community.influxdata.com/t/parse-tag-to-create-new-field-wirthout-removing-the-actual-tag/32802/1 "2024-01-14T18:02:34Z")
Hello while using inputs.win\_eventlog on collecting some events, i would like to create a field depending of the id of th event, the pb is: - the eventID is a tag, using processors.converter, i can only create a new tag value ex: ```auto [[processors.enum]] [[processors.enum.mapping]] tag = "EventID" dest = "EventTXT" [processors.enum.mapping.value_mappings 25 = "Session_connected" 26 = "Session_disconnected" 27 = "Session_broken" ``` that give something like that ```auto win_eventlog,LevelText=Information,EventID=26,EventTXT=Session_disconnected,host=MyMachine Channel="application alpha",Level=4i 1679916645000000000 ``` but i would like to have a new field instead of a new tag ```auto win_eventlog,LevelText=Information,EventID=26,host=MyMachine Channel="application alpha",EventTXT="Session_disconnected",Level=4i 1679916645000000000 ``` is this possible? ---
**Author:** ![Giovanni\_Luisotto](https://sea1.discourse-cdn.com/flex023/user_avatar/community.influxdata.com/giovanni_luisotto/32/4017_2.png) [@Giovanni\_Luisotto](https://community.influxdata.com/u/Giovanni_Luisotto)\ **Post date:** [January 15, 2024, 1:54pm UTC](https://community.influxdata.com/t/parse-tag-to-create-new-field-wirthout-removing-the-actual-tag/32802/2 "2024-01-15T13:54:14Z")
with Processor [converter](https://github.com/influxdata/telegraf/blob/master/plugins/processors/converter/README.md) you CAN convert a tag to a field ```auto [[processors.converter]] [processors.converter.tags] string = ["EventTXT"] ``` note that order may matters when using multiple processors, you can write your config in the appropriate order, or put `order = X` in the config section itself ---
**Author:** ![tonic8](https://avatars.discourse-cdn.com/v4/letter/t/6de8d8/32.png) [@tonic8](https://community.influxdata.com/u/tonic8)\ **Post date:** [January 16, 2024, 8:07am UTC](https://community.influxdata.com/t/parse-tag-to-create-new-field-wirthout-removing-the-actual-tag/32802/3 "2024-01-16T08:07:51Z")
Hello Giovanni Thanks but i want to copy or clone the tag in a field. Allowing me to filtre it via tag and show the value in a table or do calculation on it with other tools later. Convert option « move it » from tag to field, something usefull on other scenario Regards ---
**Author:** ![Giovanni\_Luisotto](https://sea1.discourse-cdn.com/flex023/user_avatar/community.influxdata.com/giovanni_luisotto/32/4017_2.png) [@Giovanni\_Luisotto](https://community.influxdata.com/u/Giovanni_Luisotto)\ **Post date:** [January 16, 2024, 2:34pm UTC](https://community.influxdata.com/t/parse-tag-to-create-new-field-wirthout-removing-the-actual-tag/32802/4 "2024-01-16T14:34:39Z")
it’s a bad idea to have tag and field with the same name, which one will be used if you reference it? you can use processors.enum twice to generate 2 tags with different names or clone it using [processors.strings](https://github.com/influxdata/telegraf/blob/master/plugins/processors/strings/README.md) (not 100% sure about this one). Then convert one form tag to field with [processors.converter](https://github.com/influxdata/telegraf/blob/master/plugins/processors/converter/README.md) ---
**Author:** ![tonic8](https://avatars.discourse-cdn.com/v4/letter/t/6de8d8/32.png) [@tonic8](https://community.influxdata.com/u/tonic8)\ **Post date:** [January 16, 2024, 9:30pm UTC](https://community.influxdata.com/t/parse-tag-to-create-new-field-wirthout-removing-the-actual-tag/32802/5 "2024-01-16T21:30:49Z")
humm technically, for my need the field can be named differently, so i will look with the option to clone the tag value to a new one with differnt name and then convert it. thanks a lot. ---
**Author:** ![tonic8](https://avatars.discourse-cdn.com/v4/letter/t/6de8d8/32.png) [@tonic8](https://community.influxdata.com/u/tonic8)\ **Post date:** [January 26, 2024, 7:11pm UTC](https://community.influxdata.com/t/parse-tag-to-create-new-field-wirthout-removing-the-actual-tag/32802/6 "2024-01-26T19:11:12Z")
So i respond to myself with the solution that is in place now: first we clone the tag to a new name Second we convert it tag → field third we rename it again to correspond to the final field fourth i convert the integer value to a human readable value ```auto ## create a new tag, this is temporary as the next block convert the tag in field [[processors.regex.tags]] key = "EventID" result_key = "Event_ID" [[processors.converter]] [processors.converter.tags] integer = ["Event_ID"] ## create a new field with a simple short name/description depending of the ID [[processors.enum]] [[processors.enum.mapping]] ## Name of the field to map. Globs accepted. field = "Event_ID" dest = "EventTXT" ## Default value to be used for all values not contained in the mapping ## table. When unset and no match is found, the original field will remain ## unmodified and the destination tag or field will not be created. # default = 0 ## Table of mappings [processors.enum.mapping.value_mappings] 25 = "ICA Session Connected" 26 = "ICA Session Disconnected" 27 = "ICA Connection Broken" 1015 = "LSASS crash" ``` Objective is to guard the tag allowing filter by tag, and when data is presented field is readable by a human. Have a nice day! p.s. if there is a better way to proceed i have no pb to change that 🙂