# Can we extract folder and file out of log.file.path field?
**URL:** https://discuss.elastic.co/t/can-we-extract-folder-and-file-out-of-log-file-path-field/216722
**Category:** Kibana
**Created:** [January 27, 2020, 8:57pm UTC](https://discuss.elastic.co/t/can-we-extract-folder-and-file-out-of-log-file-path-field/216722 "2020-01-27T20:57:30Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)
#### Post date: [January 27, 2020, 8:57pm UTC](https://discuss.elastic.co/t/can-we-extract-folder-and-file-out-of-log-file-path-field/216722/1 "2020-01-27T20:57:31Z")
Hi, I want to extract the folder and file name out of log.file.path filed we have in kibana. SO for example-
```auto
C:\Program Files (x86)\xxx SST\DispatcherAPP\logs\dispatcher.log
```
In this file path, I want to create a field which just shows DispatcherApp\dispatcher.log.
And I have multiple files under multiple prospectors in filebeat.yml so this field I could add will be for all different folder and file name.
---
### Author:  [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)
#### Post date: [January 28, 2020, 1:36pm UTC](https://discuss.elastic.co/t/can-we-extract-folder-and-file-out-of-log-file-path-field/216722/2 "2020-01-28T13:36:44Z")
You can use a scripted field and the substring Java function in order to achieve this, but I'd recommend you do it from ingest time, either in FIlebeat, Logstash or in an Elasticsearch pipeline processor as it's done only once. If you do it with a scripted field it will be done every single time you query the data.
---
### Author:  [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)
#### Post date: [January 28, 2020, 6:17pm UTC](https://discuss.elastic.co/t/can-we-extract-folder-and-file-out-of-log-file-path-field/216722/3 "2020-01-28T18:17:44Z")
How can it be done from filebeat or logstash?
---
### Author:  [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)
#### Post date: [January 29, 2020, 10:51am UTC](https://discuss.elastic.co/t/can-we-extract-folder-and-file-out-of-log-file-path-field/216722/4 "2020-01-29T10:51:39Z")
This is the guide on what Filebeat can do in regards to data processing:
[https://www.elastic.co/guide/en/beats/filebeat/7.5/filtering-and-enhancing-data.html](https://www.elastic.co/guide/en/beats/filebeat/7.5/filtering-and-enhancing-data.html)
As for logstash, the Grok and the dissect filter: [https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html)
For more info on them, the forums regarding those 2 products will be of more help.
---
### Author:  [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)
#### Post date: [February 4, 2020, 7:05pm UTC](https://discuss.elastic.co/t/can-we-extract-folder-and-file-out-of-log-file-path-field/216722/5 "2020-02-04T19:05:20Z")
I have data being processed how the documentation mentions. But my error is coming when I write an if statement on log file path to apply grok filter on. Something like this-
```auto
if [fields][tags] == "obapp-dotnet" {
grok {
break_on_match => false
match => ["path","%{GREEDYDATA}/%{GREEDYDATA:filename}\.log"]
if [path] = "dispatcher.log" {
grok{
match => {
"message" => [%{DATESTAMP:timestamp}%{SPACE}%{NONNEGINT:code}%{GREEDYDATA}%{LOGLEVEL}%{SPACE}%{NONNEGINT:anum}%{SPACE}%{GREEDYDATA:logmessage}]
}
}
else {
match => {
"message" => [\A%{TIMESTAMP_ISO8601:timestamp}%{SPACE}%{GREEDYDATA}%{SPACE}%{LOGLEVEL:logLevel}%{SPACE}%{GREEDYDATA}%{SPACE}%{JAVACLASS:javaClass}
]
}
}
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 3, 2020, 7:05pm UTC](https://discuss.elastic.co/t/can-we-extract-folder-and-file-out-of-log-file-path-field/216722/6 "2020-03-03T19:05:20Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.