diff --git a/conf.d/15-others.conf b/conf.d/15-others.conf
index 406f7ab72f85cf43eb4d0879f9bfd9b30d063062..5ba47a8b255fc853c144e56ec3619d9acecb246b 100644
--- a/conf.d/15-others.conf
+++ b/conf.d/15-others.conf
@@ -1,7 +1,7 @@
 # 15-others.conf
 filter {
   if "pf" in [tags] {
-    if [application] =~ /^dhcpd$/ {
+    if [syslog_program] =~ /^dhcpd$/ {
       mutate {
         add_tag => [ "dhcpd" ]
       }
@@ -10,17 +10,17 @@ filter {
         match => [ "message", "%{DHCPD}"]
       }
     } 
-    if [application] =~ /^charon$/ {
+    if [syslog_program] =~ /^charon$/ {
       mutate {
         add_tag => [ "ipsec" ]
       }
     }
-    if [application] =~ /^barnyard2/ {
+    if [syslog_program] =~ /^barnyard2/ {
       mutate {
         add_tag => [ "barnyard2" ]
       }
     }
-    if [application] =~ /^openvpn/ {
+    if [syslog_program] =~ /^openvpn/ {
       mutate {
         add_tag => [ "openvpn" ]
       }
@@ -29,12 +29,12 @@ filter {
         match => [ "message", "%{OPENVPN}"]
       }
     }
-    if [application] =~ /^ntpd/ {
+    if [syslog_program] =~ /^ntpd/ {
       mutate {
         add_tag => [ "ntpd" ]
       }
     }
-    if [application] =~ /^php-fpm/ {
+    if [syslog_program] =~ /^php-fpm/ {
       mutate {
         add_tag => [ "web_portal" ]
       }
@@ -46,7 +46,7 @@ filter {
         lowercase => [ 'pf_ACTION' ]
       }
     }
-    if [application] =~ /^apinger/ {
+    if [syslog_program] =~ /^apinger/ {
       mutate {
         add_tag => [ "apinger" ]
       }