Extract folder name as field in logstash

[anushka1203]

Hi everyone
The following is my filebeat input in my yml file-

filebeat.inputs:

# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.

# filestream is an input for collecting log messages from files.
- type: log

  # Change to true to enable this input configuration.
  enabled: true

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - C:\elk stack\logs\*\*\*\access.log

  tags: ["access"]

How can i extract a folder name as a field in my logstash config file?
for example, if my filepath is

C:\elk stack\logs\unit 1\LOGS-2022-1-2-12-30-17\lighttpd-2022-1-2-12-30-17\access.log

I need "unit 1" as an extracted value in a field named "tail_no."

Help would be appreciated

Thanks in advance

[Rios]

From some reason split by \ is working in Ruby as split("\") -double backslash,however LS from some reason cannot accept that. If you replace with a special character like | or # then split it's working fine.

    mutate {
         copy => { "message" => "filepath" }
      }
	 mutate {
	    gsub => [ "filepath", "[^\\]+$", "" ]
	 }
	 mutate {
	   gsub => [ "filepath", "[\\]", "|" ]
	 }
	 mutate {
	   split  => { "filepath" => '|' }
	   add_field  => { "tail_no" => '%{[filepath][3]}' }
	 }

[anushka1203]

my file path gets saved in the field called log.file.path
how do i change your code accordingly cause right now i am getting this as the tail_no. field -

[anushka1203]

i also tried replacing "filepath" with "[log][file][path]" but it still gives the tail_no. as %{[log][file][path][3]}

[Rios]

This will work:

  mutate {
         copy => { "[log][file][path]" => "filepath" }
      }
	 mutate {
	    gsub => [ "filepath", "[^\\]+$", "" ]
	 }
	 mutate {
	   gsub => [ "filepath", "[\\]", "|" ]
	 }
	 mutate {
	   split  => { "filepath" => '|' }
	   add_field  => { "tail_no" => '%{[filepath][3]}' }
	 }

[anushka1203]

it works, thank you so much!

[Rios]

Also you can have a cleaner output with @metadata

   mutate {
        copy => { "[log][file][path]" => "[@metadata][filepath]" }
     }
	 mutate {
	    gsub => [ "[@metadata][filepath]", "[^\\]+$", "" ]
	 }
	 mutate {
	   gsub => [ "[@metadata][filepath]", "[\\]", "|" ]
	 }
	 mutate {
	   split  => { "[@metadata][filepath]" => '|' }
	   add_field  => { "tail_no" => '%{[@metadata][filepath][3]}' }
	 }

[anushka1203]

noted. will implement this. thanks again!