Extract folder name as field in logstash

Elastic Stack Beats
7

Also you can have a cleaner output with @metadata

   mutate {
        copy => { "[log][file][path]" => "[@metadata][filepath]" }
     }
	 mutate {
	    gsub => [ "[@metadata][filepath]", "[^\\]+$", "" ]
	 }
	 mutate {
	   gsub => [ "[@metadata][filepath]", "[\\]", "|" ]
	 }
	 mutate {
	   split  => { "[@metadata][filepath]" => '|' }
	   add_field  => { "tail_no" => '%{[@metadata][filepath][3]}' }
	 }