# Differentiate between logs based on log.file.path **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [May 10, 2019, 6:45am UTC](https://discuss.elastic.co/t/differentiate-between-logs-based-on-log-file-path/180496 "2019-05-10T06:45:21Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![rplus](https://avatars.discourse-cdn.com/v4/letter/r/34f0e0/32.png) [@rplus](https://discuss.elastic.co/u/rplus)\ **Post date:** [May 10, 2019, 6:45am UTC](https://discuss.elastic.co/t/differentiate-between-logs-based-on-log-file-path/180496/1 "2019-05-10T06:45:21Z")
Hi, I've a server hosting several sites containing multiple IIS logs from each site in structure like this: D:\IISLogs\Customer1\logs D:\IISLogs\Customer2\logs D:\IISLogs\Customer3\logs I'm using filebeat with IIS module to send the logs to logstash and then output them to elasticsearch. I would like to differentiate between the logs in kibana, preferably by customer name. I've seen that filebeat adds log.file.path as metadata. Is there anyway to add a field with the customers name based on the log.file.path? Thanks in advance. ---
**Author:** ![martinr\_ubi](https://avatars.discourse-cdn.com/v4/letter/m/b5e925/32.png) [@martinr\_ubi](https://discuss.elastic.co/u/martinr_ubi)\ **Post date:** [May 10, 2019, 8:26am UTC](https://discuss.elastic.co/t/differentiate-between-logs-based-on-log-file-path/180496/2 "2019-05-10T08:26:36Z")
Hi, With filebeat dissect processor you could extract the customer from the log.file.path field and save it to another field. ---
**Author:** ![rplus](https://avatars.discourse-cdn.com/v4/letter/r/34f0e0/32.png) [@rplus](https://discuss.elastic.co/u/rplus)\ **Post date:** [May 13, 2019, 7:10am UTC](https://discuss.elastic.co/t/differentiate-between-logs-based-on-log-file-path/180496/3 "2019-05-13T07:10:30Z")
Hey, thanks for your reply. I did check out the filebeat documentation for dissect, however I'm still not sure how it functions. I've posted the following in my filebeat.yml configuration file under Processors: processors: - dissect: tokenizer: "%{Key1} - %{Key2}" field: "log.file.path" target\_prefix: "NewFieldCustomerName" But i'm not sure how I should set up the tokenizer pattern to match the customer name in my file structure, any advice would be greatly appreciated. Thanks in advance. ---
**Author:** ![martinr\_ubi](https://avatars.discourse-cdn.com/v4/letter/m/b5e925/32.png) [@martinr\_ubi](https://discuss.elastic.co/u/martinr_ubi)\ **Post date:** [May 20, 2019, 10:01am UTC](https://discuss.elastic.co/t/differentiate-between-logs-based-on-log-file-path/180496/4 "2019-05-20T10:01:31Z")
Hi, I agree the filebeat documentation for the dissect processor is a bit thin. I can recommend reading the documentation for the logstash dissect filter plugin which explains in more details how it works and how it can be used to extract information from fields/strings. [https://www.elastic.co/guide/en/logstash/current/plugins-filters-dissect.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-dissect.html) There is also a blog post here: > **[Introducing Logstash Dissect](https://www.elastic.co/blog/logstash-dude-wheres-my-chainsaw-i-need-to-dissect-my-logs)** > > Introducing Logstash Dissect, an alternative way to extract fields from text I'm not saying that filebeat implementation is exactly the same as logstash though. I don't know. You should open an issue on github about the documentation for the filebeat dissect processor because it is indeed lacking. If the implementation is the same, it could include a link to the logstash dissect. It could also mentions the differences if there are any. ---
**Author:** ![buzzlightyear](https://avatars.discourse-cdn.com/v4/letter/b/3da27b/32.png) [@buzzlightyear](https://discuss.elastic.co/u/buzzlightyear)\ **Post date:** [May 20, 2019, 2:58pm UTC](https://discuss.elastic.co/t/differentiate-between-logs-based-on-log-file-path/180496/5 "2019-05-20T14:58:09Z")
Your tokenizer should probably be something like "%{}\%{}\%{customername}\%{}\%{}" to match a log.file.path value of _D:\IISLogs\Customer1\logs\logfile.txt_ and extract _Customer1_ into _customername_ ---
**Author:** ![rplus](https://avatars.discourse-cdn.com/v4/letter/r/34f0e0/32.png) [@rplus](https://discuss.elastic.co/u/rplus)\ **Post date:** [May 21, 2019, 8:44am UTC](https://discuss.elastic.co/t/differentiate-between-logs-based-on-log-file-path/180496/6 "2019-05-21T08:44:03Z")
Hello, Thank you for you reply. I've added the following to my filebeat configuraiton under processors: processors: - add\_host\_metadata: ~ - add\_cloud\_metadata: ~ processors: - dissect: tokenizer: "%{}\{customername}\%{}" field: "log.file.path" target\_prefix: "Customer" For testing purposes I've a log path which looks like the following: C:\customer\u\_ex160121.log I had to use double \ to esacpe the backslash otherwise filebeat wont start. I run logging.level: debug but I can't see any trace that any dissection is happening at all. Thanks yet again, very helpful. ---
**Author:** ![rplus](https://avatars.discourse-cdn.com/v4/letter/r/34f0e0/32.png) [@rplus](https://discuss.elastic.co/u/rplus)\ **Post date:** [May 22, 2019, 1:23pm UTC](https://discuss.elastic.co/t/differentiate-between-logs-based-on-log-file-path/180496/7 "2019-05-22T13:23:49Z")
Hi, thanks for you reply. I accidentally replied to my own thread instead of your response. ---
**Author:** ![buzzlightyear](https://avatars.discourse-cdn.com/v4/letter/b/3da27b/32.png) [@buzzlightyear](https://discuss.elastic.co/u/buzzlightyear)\ **Post date:** [May 22, 2019, 1:39pm UTC](https://discuss.elastic.co/t/differentiate-between-logs-based-on-log-file-path/180496/8 "2019-05-22T13:39:24Z")
You are missing the percentage in front of the {customername}, it should look like below: `tokenizer: "%{}\%{customername}\%{}"` Every field you want to recognise should be of the form %{} ---
**Author:** ![rplus](https://avatars.discourse-cdn.com/v4/letter/r/34f0e0/32.png) [@rplus](https://discuss.elastic.co/u/rplus)\ **Post date:** [May 23, 2019, 5:27am UTC](https://discuss.elastic.co/t/differentiate-between-logs-based-on-log-file-path/180496/9 "2019-05-23T05:27:59Z")
Wow, my bad. Thank you. It works like a charm. Now I get a field called "Customer" with the actual customer name as the value. Cheers! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 20, 2019, 5:28am UTC](https://discuss.elastic.co/t/differentiate-between-logs-based-on-log-file-path/180496/10 "2019-06-20T05:28:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.