# Extracting filename from existing source field?

**URL:** https://discuss.elastic.co/t/extracting-filename-from-existing-source-field/156015
**Category:** Logstash
**Created:** [November 9, 2018, 9:24am UTC](https://discuss.elastic.co/t/extracting-filename-from-existing-source-field/156015 "2018-11-09T09:24:08Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![roly](https://avatars.discourse-cdn.com/v4/letter/r/7c8e57/32.png) [@roly](https://discuss.elastic.co/u/roly)
#### Post date: [November 9, 2018, 9:24am UTC](https://discuss.elastic.co/t/extracting-filename-from-existing-source-field/156015/1 "2018-11-09T09:24:08Z")

</div>

How do i extract source filename from the existing field which standard field from logstash which is (Source)?

```
input {
  beats {
    port => 5044
    host => "0.0.0.0"
  }
}

filter {
  grok {
    patterns_dir => ["/etc/logstash/conf.d/patterns"]
    match => { "message" => "%{LOGLEVEL:log_lvl}\s+\[%{TIMESTAMP_ISO8601:time_stamp}\]\s+\[%{REQID:req_id}\]\s+%{JAVACLASS:class_name}:\s+%{JAVALOGMESSAGE:log_msg}" }
    match => { "sourcename" => "/var/log/.*?/(?<logfolder>.*?)/" }
  }
 mutate {
    remove_field => ["message"]
    #remove_field => ["beat"]
    remove_field => ["[host]"]
 }
 mutate {
   add_field => {
        "host" => "%{[beat][hostname]}"
   }
 }
}

output {
        elasticsearch {
                user => "elastic"
                password => "changeme"
                hosts => "localhost:9200"
                manage_template => false
                index => "logstash-%{+YYYY.MM.dd}"
                document_type => "%{[@metadata][type]}"
        }
}

```

we are not getting any result as sourcename field !!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 7, 2018, 9:24am UTC](https://discuss.elastic.co/t/extracting-filename-from-existing-source-field/156015/2 "2018-12-07T09:24:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.