input { beats { port => 5044 tags => "beats" } } filter { if [beat][hostname] == "filebeathost" { mutate { add_tag => ["nessus"] } } }