Tagging: Since event types can also be tagged, tag values assigned to certain eventtype="failed_login" tag::user="admin" (eventtype=login loglevel=error) .