Hi, I've a server hosting several sites containing multiple IIS logs from each site in structure like this: D:\IISLogs\Customer1\logs D:\IISLogs\Customer2\logs D:\IISLogs\Customer3\logs I'm using filebeat with IIS module to send the logs to logstash and then output them to elasticsearch. I wou…

You are missing the percentage in front of the {customername}, it should look like below: tokenizer: "%{}\%{customername}\%{}" Every field you want to recognise should be of the form %{}

Discuss the Elastic Stack

Differentiate between logs based on log.file.path

Elastic Stack Beats

rplus (Rasmus Gärdekrans) May 22, 2019, 1:23pm 7

Hi, thanks for you reply. I accidentally replied to my own thread instead of your response.

Topic		Replies	Views
Can we extract folder and file out of log.file.path field? Kibana	5	3009	March 3, 2020
Help with 'dissect_parsing_error' on 'log file path' Beats filebeat	2	4443	August 30, 2020
Extract fields from a log path in logstash Logstash	3	351	July 19, 2018
How to customize a filebeat to parse a log? Beats filebeat	3	12492	October 16, 2020
About FileBeat Dissect processor Beats filebeat	2	956	October 28, 2022

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Differentiate between logs based on log.file.path

Related topics