title: Changing tags dynamically
body: <p>My goal is to be able to change log tags based on their content, and then dump them to a special, non-default index in elastic (the default index name is <code>logstash-%date%</code>).<br>
  I use the <code>https://github.com/uken/fluent-plugin-elasticsearch</code> plugin in order to be able to dump logs to elastic (<a href="https://github.com/kubernetes/kubernetes/blob/master/cluster/addons/fluentd-elasticsearch/fluentd-es-configmap.yaml" rel="nofollow noreferrer">with the following default configmap</a>).</p>
  
  <p>However, I will try to summarize the relevant parts of the config so a person which is not familiar with kubernetes but also with vanilla fluentd will be able to understand.</p>
  
  <p>Here is the config file:</p>
  
  <pre><code>&lt;source&gt;
    tags all pods logs with "kubernetes.*" tag
  &lt;/source&gt;
  
  &lt;filter kubernetes.**&gt;
    @type grep
    &lt;regex&gt;
      key name
      pattern ^bi$
    &lt;/regex&gt;
  &lt;/filter&gt;
  
  &lt;filter kubernetes.**&gt;
    @type record_transformer
    &lt;record&gt;
      tag bi
    &lt;/record&gt;
  &lt;/filter&gt;
  
  &lt;match bi&gt;
    @type elasticsearch
    host ...
    port ...
    index_name bi
  &lt;/match&gt;
  </code></pre>
  
  <p>What I'm trying to do here, is first filter all logs tagged with "kubernetes.**", and check if their "name" field contains "bi" (throwed from my app).<br>
  Then, the next filter should change the tag to "bi" for logs that matched the previous filter.<br>
  Finally, I try to catch the logs tagged with "bi" and dump them to a special index named "bi".</p>
  
  <p>However, the configuration doesn't manage to change the log tags.  </p>