Duplicate field

Elastic Stack Logstash
1

hi,
I am trying to parse the file name from the source field without the path, I trid to do the following:
grok {
match => ["source", "%{GREEDYDATA}/%{GREEDYDATA}/%{GREEDYDATA:filename9}"]
#add_field => { "filename9" => "%{filename9}.gababa" }
}

I am getting only the filename (without the path - which is good) but twice. for example
myfile.log myfile.log

any idea?

2

Can we see the entire config?

3

Don't use multiple GREEDYDATA in a single expression. Please also show us what the data looks like in addition to the full config requested by Mark.