# Extracting fields from path and adding them to new elapsed events

**URL:** <https://discuss.elastic.co/t/extracting-fields-from-path-and-adding-them-to-new-elapsed-events/200820>\
**Category:** Logstash\
**Created:** [September 24, 2019, 8:32am UTC](https://discuss.elastic.co/t/extracting-fields-from-path-and-adding-them-to-new-elapsed-events/200820 "2019-09-24T08:32:55Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alisa\_Faingold](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alisa_faingold/32/45836_2.png) [@Alisa\_Faingold](https://discuss.elastic.co/u/Alisa_Faingold)\
**Post date:** [September 24, 2019, 8:32am UTC](https://discuss.elastic.co/t/extracting-fields-from-path-and-adding-them-to-new-elapsed-events/200820/1 "2019-09-24T08:32:56Z")

</div>

Hi all,  
I have files stored as follows:  
c: /..../ agency / device / log.txt  
I want to extract the fields of agency and the device and add them to each event in the log.  
Now I'm doing this using a grok filter, and it does work well for all the events in the log, but I want these fields to be added to new elapsed events created, and I'm necessarily interested in creating a new event.

This is how my log looks right now:  
filter  
{  
grok {  
match =\> {path =\> "%{GREEDYDATA}/%{GREEDYDATA:agency}/ {GREEDYDATA:device}/%{GREEDYDATA}.txt"}  
}  
elapsed{  
start\_tag =\> "a"  
end\_tag =\> "b"  
unique\_id\_field =\> "host"  
timeout =\> 100000   
new\_event\_on\_match =\> true  
add\_tag =\> "ab"  
keep\_start\_event=\>last  
}  
}

Is there any way to do that?  
Thank you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 22, 2019, 8:33am UTC](https://discuss.elastic.co/t/extracting-fields-from-path-and-adding-them-to-new-elapsed-events/200820/2 "2019-10-22T08:33:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.