this path are sometime 10 level deep and sometime 20.
this is what I have
full_file_name: /home/sachin/Tests/noise/spread/xspread/xspread_a_10_v1.tl.gz
project: sachin
file_name: xspread_a_10_v1.tl.gz
to new field
url_file: 'http://server1/Projects/JMV3/less_file.php?project=sachin&act=multiview&path=%2F%2Fhome%2sachin%2FTests%2Fnoise%2Fspread%2Fspred%2F&files=xspread_a_10_v1.tl.gz'
and from full path I got file_name
grok {
match => { "file_path" => "%{GREEDYDATA:api_class}" }
}
mutate {
# split the field on /
split => ["api_class" , "/"]
# save the last element of the array as the api_method.
add_field => ["file_name", "%{[api_class][-1]}" ]
}
grok { match => { "file_path" => "%{GREEDYDATA:location}(/%{DATA}.log)" } }
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.