thanks for the direction.
i used the below grok and i can fetch the year, month and date ([2016_07_21][19_21_12])
grok {
match => ["filename", "%{YEAR:year}%{MONTHNUM:month}%{MONTHDAY:day}"]
add_field => ["date", "%{month}/%{day}/%{year} "]
}
but i am not sure how to fetch the hour, mins and secs.
can you please help?