# Capture a substring from a windows path

**URL:** <https://discuss.elastic.co/t/capture-a-substring-from-a-windows-path/218533>\
**Category:** Logstash\
**Created:** [February 10, 2020, 8:09am UTC](https://discuss.elastic.co/t/capture-a-substring-from-a-windows-path/218533 "2020-02-10T08:09:11Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Radha\_Krishna](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/radha_krishna/32/54597_2.png) [@Radha\_Krishna](https://discuss.elastic.co/u/Radha_Krishna)\
**Post date:** [February 10, 2020, 8:09am UTC](https://discuss.elastic.co/t/capture-a-substring-from-a-windows-path/218533/1 "2020-02-10T08:09:12Z")

</div>

I need to capture **services.exe** from the path **C:\Windows\System32\services.exe** , but for every event the path changes dynamically. What would be a generic way to capture whatever is there after the last **\**.

Thanks in advance

---

<div class="post-metadata">

**Author:** ![Fabio-sama](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\
**Post date:** [February 10, 2020, 2:48pm UTC](https://discuss.elastic.co/t/capture-a-substring-from-a-windows-path/218533/2 "2020-02-10T14:48:56Z")

</div>

Hi there,

supposing your path is in the `path` field, have you tried a filter like:

```
ruby {
  code => """
    if path=event.get('path') 
      event.set('new_field', path.split('\\')[-1])
    end
  """
}
```

---

<div class="post-metadata">

**Author:** ![Radha\_Krishna](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/radha_krishna/32/54597_2.png) [@Radha\_Krishna](https://discuss.elastic.co/u/Radha_Krishna)\
**Post date:** [February 11, 2020, 7:22am UTC](https://discuss.elastic.co/t/capture-a-substring-from-a-windows-path/218533/3 "2020-02-11T07:22:53Z")

</div>

if [PathName] {  
ruby {  
code =\> "event.set('PathName', event.get('Path').split('\').last)"  
}  
}  
Working for me.

---

<div class="post-metadata">

**Author:** ![Fabio-sama](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\
**Post date:** [February 11, 2020, 10:41am UTC](https://discuss.elastic.co/t/capture-a-substring-from-a-windows-path/218533/4 "2020-02-11T10:41:14Z")

</div>

Sure! Your solution is my same solution (I simply escaped the backslash and `[-1]` is the same as `last` in ruby) but I'd add that check on the existence of field `path` since if it doesn't exist (very unlikely but who knows) the pipeline will break.

---

<div class="post-metadata">

**Author:** ![Radha\_Krishna](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/radha_krishna/32/54597_2.png) [@Radha\_Krishna](https://discuss.elastic.co/u/Radha_Krishna)\
**Post date:** [February 11, 2020, 10:42am UTC](https://discuss.elastic.co/t/capture-a-substring-from-a-windows-path/218533/5 "2020-02-11T10:42:45Z")

</div>

Agree. In fact i do have the check.  
Edited my solution.

---

<div class="post-metadata">

**Author:** ![Fabio-sama](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\
**Post date:** [February 11, 2020, 10:49am UTC](https://discuss.elastic.co/t/capture-a-substring-from-a-windows-path/218533/6 "2020-02-11T10:49:26Z")

</div>

Mhmh think you gotta edit it again since you're checking for the existence of field `PathName` and then try to retrieve something from field `Path`.

It makes no sense to perform such a check. Also, it'll most likely skip the ruby filter unless you have a `PathName` field in your source event.

P.S. also, format your code before publishing the post, using this tool ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/4/34ae7c264eb001993416cae07490e590fb8f746e.png)

---

<div class="post-metadata">

**Author:** ![Radha\_Krishna](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/radha_krishna/32/54597_2.png) [@Radha\_Krishna](https://discuss.elastic.co/u/Radha_Krishna)\
**Post date:** [February 14, 2020, 7:02am UTC](https://discuss.elastic.co/t/capture-a-substring-from-a-windows-path/218533/7 "2020-02-14T07:02:42Z")

</div>

My bad. I have overlooked it. Thanks for correcting.  
if [Path] {  
ruby {  
code =\> "event.set('PathName', event.get('Path').split('\').last)"  
}  
}

---

<div class="post-metadata">

**Author:** ![Fabio-sama](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\
**Post date:** [February 14, 2020, 8:36am UTC](https://discuss.elastic.co/t/capture-a-substring-from-a-windows-path/218533/8 "2020-02-14T08:36:01Z")

</div>

> P.S. also, format your code before publishing the post, using this tool ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/4/34ae7c264eb001993416cae07490e590fb8f746e.png)

This instruction is so darn harsh for you guys to follow, isn't it? 😅

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 13, 2020, 8:36am UTC](https://discuss.elastic.co/t/capture-a-substring-from-a-windows-path/218533/9 "2020-03-13T08:36:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.