Add file path as a field

Elastic Stack Logstash
1

Hey guys,
Is it possible to add a field for the file path?

input{
 file{
	  path => [ "/bitnami/jenkins/jenkins_home/jobs/create-machine/builds/**/log", "/bitnami/jenkins/jenkins_home/jobs/delete-machine/builds/**/log" ]
	  add_field => { "component" => "Jenkins_Jobs" }
	  add_field => { "level" => "INFO" }
	  add_field => { "module" => "JOB" }
	  # Any line not starting with a timestamp should be merged with the previous line
	codec => multiline {
	  # Regex for iso datetime
	  pattern => "\[(\d{4}-\d{2}-\d{2})[A-Z]+(\d{2}:\d{2}:\d{2}).([0-9+-:]+)Z\]"
	  negate => true
	  what => "previous"
	}
 }
}
filter {
	if [component] ==  "Jenkins_Jobs" {
		dissect {
		  mapping => {
			"message" => "%{timestamp} %{message}"
			}
		}
	}
    else if ("_dissectfailure" in [tags]) {
        drop { }
    }
}
2

The filter already does that.

3

Can i use it like this? I need to pass it as a different field name.

	  add_field => { "component" => "[log][file][path]" }
4

You could use

add_field => { "component" => "%{[log][file][path]}" }`
5

it doesn't work for me.
I see this in the logs.
"module" => "%{[log][file][path]}",
image

6

It works now when using

add_field => { "component" => "%{path}" }

thanks for your help @Badger

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.