# Add file path as a field

**URL:** <https://discuss.elastic.co/t/add-file-path-as-a-field/318966>\
**Category:** Logstash\
**Created:** [November 15, 2022, 1:44pm UTC](https://discuss.elastic.co/t/add-file-path-as-a-field/318966 "2022-11-15T13:44:28Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Matan\_Malka](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matan_malka/32/99030_2.png) [@Matan\_Malka](https://discuss.elastic.co/u/Matan_Malka)\
**Post date:** [November 15, 2022, 1:44pm UTC](https://discuss.elastic.co/t/add-file-path-as-a-field/318966/1 "2022-11-15T13:44:28Z")

</div>

Hey guys,  
Is it possible to add a field for the file path?

```auto
input{
 file{
	  path => ["/bitnami/jenkins/jenkins_home/jobs/create-machine/builds/ **/log", "/bitnami/jenkins/jenkins_home/jobs/delete-machine/builds/** /log"]
	  add_field => { "component" => "Jenkins_Jobs" }
	  add_field => { "level" => "INFO" }
	  add_field => { "module" => "JOB" }
	  # Any line not starting with a timestamp should be merged with the previous line
	codec => multiline {
	  # Regex for iso datetime
	  pattern => "\[(\d{4}-\d{2}-\d{2})[A-Z]+(\d{2}:\d{2}:\d{2}).([0-9+-:]+)Z\]"
	  negate => true
	  what => "previous"
	}
 }
}
filter {
	if [component] == "Jenkins_Jobs" {
		dissect {
		  mapping => {
			"message" => "%{timestamp} %{message}"
			}
		}
	}
    else if ("_dissectfailure" in [tags]) {
        drop { }
    }
}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 15, 2022, 1:51pm UTC](https://discuss.elastic.co/t/add-file-path-as-a-field/318966/2 "2022-11-15T13:51:21Z")

</div>

> [@Matan\_Malka](#):
>
> Is it possible to add a field for the file path?

The filter [already does that](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html#plugins-inputs-file-ecs).

---

<div class="post-metadata">

**Author:** ![Matan\_Malka](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matan_malka/32/99030_2.png) [@Matan\_Malka](https://discuss.elastic.co/u/Matan_Malka)\
**Post date:** [November 15, 2022, 1:58pm UTC](https://discuss.elastic.co/t/add-file-path-as-a-field/318966/3 "2022-11-15T13:58:36Z")

</div>

Can i use it like this? I need to pass it as a different field name.

```auto
	  add_field => { "component" => "[log][file][path]" }

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 15, 2022, 2:13pm UTC](https://discuss.elastic.co/t/add-file-path-as-a-field/318966/4 "2022-11-15T14:13:33Z")

</div>

You could use

```
add_field => { "component" => "%{[log][file][path]}" }`

```

---

<div class="post-metadata">

**Author:** ![Matan\_Malka](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matan_malka/32/99030_2.png) [@Matan\_Malka](https://discuss.elastic.co/u/Matan_Malka)\
**Post date:** [November 15, 2022, 2:28pm UTC](https://discuss.elastic.co/t/add-file-path-as-a-field/318966/5 "2022-11-15T14:28:38Z")

</div>

it doesn't work for me.  
I see this in the logs.  
"module" =\> "%{[log][file][path]}",  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/d/6dce74be3d4d56107665024c5c3856ec3551f338.png)

---

<div class="post-metadata">

**Author:** ![Matan\_Malka](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matan_malka/32/99030_2.png) [@Matan\_Malka](https://discuss.elastic.co/u/Matan_Malka)\
**Post date:** [November 15, 2022, 3:40pm UTC](https://discuss.elastic.co/t/add-file-path-as-a-field/318966/6 "2022-11-15T15:40:53Z")

</div>

It works now when using

```auto
add_field => { "component" => "%{path}" }

```

thanks for your help @Badger

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 13, 2022, 3:41pm UTC](https://discuss.elastic.co/t/add-file-path-as-a-field/318966/7 "2022-12-13T15:41:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.