# Add a field starting from a substring of the file name

**URL:** https://discuss.elastic.co/t/add-a-field-starting-from-a-substring-of-the-file-name/266337
**Category:** Logstash
**Created:** [March 5, 2021, 9:03am UTC](https://discuss.elastic.co/t/add-a-field-starting-from-a-substring-of-the-file-name/266337 "2021-03-05T09:03:53Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![JuanLuis\_Santiago\_de](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juanluis_santiago_de/32/85033_2.png) [@JuanLuis\_Santiago\_de](https://discuss.elastic.co/u/JuanLuis_Santiago_de)
#### Post date: [March 5, 2021, 9:03am UTC](https://discuss.elastic.co/t/add-a-field-starting-from-a-substring-of-the-file-name/266337/1 "2021-03-05T09:03:53Z")

</div>

Hello.  
I have several logs with the following names, where [E-1].[P-28], [E-1].[P-45] and [E-1].[P-51] are operators that generate these logs (I only can identify them by obtaining from the file name)

p2sajava131.srv.gva.es\_11101.log.online.[E-1].[P-28].21.01.21.log  
p1sajava130.srv.gva.es\_11101.log.online.[E-1].[P-45].21.03.04.log  
p1sajava130.srv.gva.es\_11101.log.online.[E-1].[P-51].21.03.04.log  
...

How can i create a new field with, mutate o translate in logstash, with the next conditions:  
if contains [E-1].[P-28] =\> Operator-1  
if contains [E-1].[P-45] =\> Operator-2  
if contains [E-1].[P-51] =\> Operator-3

Thanx

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 5, 2021, 5:11pm UTC](https://discuss.elastic.co/t/add-a-field-starting-from-a-substring-of-the-file-name/266337/2 "2021-03-05T17:11:12Z")

</div>

```
    translate {
        field => "[message]"
        destination => "[someField]"
        dictionary => {
          "\[E-1\]\.\[P-28\]" => "Operator-1"
          "\[E-1\]\.\[P-45\]" => "Operator-2"
          "\[E-1\]\.\[P-51\]" => "Operator-3"
        }
        exact => true
        regex => true
    }

```

will produce events like

```
 "someField" => "Operator-3",
   "message" => "p1sajava130.srv.gva.es_11101.log.online.[E-1].[P-51].21.03.04.log",

```

Note that you do not appear to be using a regex, but it needs to be true to do a substring match.

---

<div class="post-metadata">

### Author: ![JuanLuis\_Santiago\_de](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juanluis_santiago_de/32/85033_2.png) [@JuanLuis\_Santiago\_de](https://discuss.elastic.co/u/JuanLuis_Santiago_de)
#### Post date: [March 15, 2021, 2:10pm UTC](https://discuss.elastic.co/t/add-a-field-starting-from-a-substring-of-the-file-name/266337/3 "2021-03-15T14:10:50Z")

</div>

Lot of Thanx Badger.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 12, 2021, 2:11pm UTC](https://discuss.elastic.co/t/add-a-field-starting-from-a-substring-of-the-file-name/266337/4 "2021-04-12T14:11:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.