# Can I get the current path of file being processed by Logstash file input when searching through subdirectories?

**URL:** <https://discuss.elastic.co/t/can-i-get-the-current-path-of-file-being-processed-by-logstash-file-input-when-searching-through-subdirectories/125046>\
**Category:** Logstash\
**Created:** [March 21, 2018, 5:10pm UTC](https://discuss.elastic.co/t/can-i-get-the-current-path-of-file-being-processed-by-logstash-file-input-when-searching-through-subdirectories/125046 "2018-03-21T17:10:36Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![daved](https://avatars.discourse-cdn.com/v4/letter/d/bcef8e/32.png) [@daved](https://discuss.elastic.co/u/daved)\
**Post date:** [March 21, 2018, 5:10pm UTC](https://discuss.elastic.co/t/can-i-get-the-current-path-of-file-being-processed-by-logstash-file-input-when-searching-through-subdirectories/125046/1 "2018-03-21T17:10:36Z")

</div>

Hey,

I'm wondering if there is anyway to tell what subdirectory/path to file is currently getting processed by Logstash when using the file input to look through a directory tree?

From what I understand I could parse my subdirectories in two ways given my setup, either using a recursive glob `/path/to/top/directory/**/*.log` or using a direct wildcard path: `/path/to/top/directory/*/*/*.log`

Either way would be fine for me but what I really want is to know the current path that logstash is operating on. Essentially the subdirectory tells me a name of a server like this: `/path/to/top/directory/server1/2018_03_21/foo.log`

I then want to add a field with that server number in the file input block: `add_field => {"server", "1"}`

Is this possible using logstash? Is there someway I can access the path that is currently being processed? If I could get the path I could then use `grok` to parse the server number into a variable and use that in `add_field`

Also, unfortunately I can't use filebeat in my setup.

Thanks!  
Dave

---

<div class="post-metadata">

**Author:** ![paz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paz/32/28003_2.png) [@paz](https://discuss.elastic.co/u/paz)\
**Post date:** [March 22, 2018, 3:24pm UTC](https://discuss.elastic.co/t/can-i-get-the-current-path-of-file-being-processed-by-logstash-file-input-when-searching-through-subdirectories/125046/2 "2018-03-22T15:24:09Z")

</div>

There should be a _path_ field in the final event, containing the full path (including filename), basically what you're after.

---

<div class="post-metadata">

**Author:** ![daved](https://avatars.discourse-cdn.com/v4/letter/d/bcef8e/32.png) [@daved](https://discuss.elastic.co/u/daved)\
**Post date:** [March 22, 2018, 4:42pm UTC](https://discuss.elastic.co/t/can-i-get-the-current-path-of-file-being-processed-by-logstash-file-input-when-searching-through-subdirectories/125046/3 "2018-03-22T16:42:44Z")

</div>

Yes, `path` was exactly what I needed, thanks @paz! My final solution ended up being:

```auto
input {
    file {
       path => "/path/to/top/directory/*/*/*.log"
     }
}

filter {
  grok {
      match => ["path", "^/path/to/top/directory/server(?<server>[^/]+)/"]
  }
}

```

Note that grok automatically adds named captures as a field so there is no need for `add_field`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 19, 2018, 4:43pm UTC](https://discuss.elastic.co/t/can-i-get-the-current-path-of-file-being-processed-by-logstash-file-input-when-searching-through-subdirectories/125046/4 "2018-04-19T16:43:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.