title: Assigning tags for elapsed in logstash
body: <p>I have log file that look for example like this:</p>
  
  <pre><code>2015-12-05 05:00:51 prefix1_sent 1
  2015-12-05 05:00:52 prefix2_sent 2
  2015-12-05 05:00:53 prefix1_received 1
  2015-12-05 05:00:54 prefix2_received 2
  </code></pre>
  
  <p>I want to find out how much time particular event took. I am using elapsed plugin in logstash like this:</p>
  
  <pre><code>....
  
  grok {
          patterns_dir =&gt; "path"
          match =&gt; { 
              "message" =&gt; "%{TIMESTAMP:logtime}, %{EVENT:event}, %{SPLIT:ID}"
          }
      }
  
  filter{
      if [event] == "(.)*sent" {
          if [event] == "prefix1(.)*" {
              kv {
                  add_tag =&gt; [ "prefix1_sent" ]
              }
          } else if [event] == "prefix2(.)*" {
              kv {
                  add_tag =&gt; [ "prefix2_sent" ]
              }
      } else if [event] == "(.)*received" {
          if [event] == "prefix1(.)*" {
              kv {
                  add_tag =&gt; [ "prefix1_received" ]
              }
          } else if [event] == "prefix2(.)*" {
              kv {
                  add_tag =&gt; [ "prefix2_received" ]
              }
          }
      }
  }
  filter{
      elapsed {
          start_tag =&gt; "prefix1_sent"
          end_tag =&gt; "prefix1_received"
          unique_id_field =&gt; "ID"
          new_event_on_match =&gt; false
      }
  }
  filter{
      elapsed {
          start_tag =&gt; "prefix2_sent"
          end_tag =&gt; "prefix2_received"
          unique_id_field =&gt; "ID"
          new_event_on_match =&gt; false
      }
  }
  
  ....
  </code></pre>
  
  <p>I am not sure if my syntax of nested if statement is correct of if I understand the use of "kv". I am new to logstash. However I can't find any tag in kibana with this configuration. Where am I making mistake?</p>
  
  <p>Thanks</p>