The event from filebeat contains the source field which contains the log filename. How do I use grok to extract some data from it?

Extract field from source

magnusbaeck (Magnus Bäck) April 5, 2018, 8:06pm 4

Show us your config and what an event produced by Logstash looks like. Use a stdout { codec => rubydebug } output.

Topic		Replies	Views
Windows source grok match Logstash	3	973	July 6, 2017
How to get filebeat source date field? Beats	5	532	January 4, 2019
Logstash/Grok help Logstash	5	461	May 31, 2017
Couldn't extract filename from "source" field Logstash	3	1461	July 6, 2017
Logstash "_grokparsefailure" in output Logstash	6	2153	March 13, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Extract field from source

Related topics