Extracting particular folder from the path and adding that to a field

Elastic Stack Logstash
4

OK, so a UNIX path contain directory names separated by /. A directory name cannot contain /. So you could either go after the 4th directory name, or the last but one directory name. Either of these should work

    grok { match => [ "message", "^/[^/]+/[^/]+/[^/]+/(?<dir1>[^/]+)" ] }
    grok { match => [ "message", "/(?<dir2>[^/]+)/[^/]+/[^/]+$" ] }