diff --git a/fluent-logging/values.yaml b/fluent-logging/values.yaml
index 056320d502..7b8212a70c 100644
--- a/fluent-logging/values.yaml
+++ b/fluent-logging/values.yaml
@@ -288,6 +288,35 @@ conf:
               key: level
               pattern: CRITICAL
               tag: critical.${tag}
+      #NOTE(tp6510): This prefixes the tag for auth entries
+      # it allows for lookups on openstack logs with
+      # a particular auth log (ie: auth.openstack.keystone)
+    - tag_auth_log:
+        header: match
+        type: rewrite_tag_filter
+        expression: "*.openstack.**"
+        rule:
+          -
+            - header: rule
+              key: application
+              pattern: keystone
+              tag: auth.${tag}
+            - header: rule
+              key: application
+              pattern: horizon
+              tag: auth.${tag}
+            - header: rule
+              key: application
+              pattern: mariadb
+              tag: auth.${tag}
+            - header: rule
+              key: application
+              pattern: memcached
+              tag: auth.${tag}
+            - header: rule
+              key: application
+              pattern: rabbitmq
+              tag: auth.${tag}
     - journal_elasticsearch:
         header: match
         type: elasticsearch