# Extracting string from log path
**URL:** https://discuss.elastic.co/t/extracting-string-from-log-path/284748
**Category:** Logstash
**Created:** [September 21, 2021, 3:47pm UTC](https://discuss.elastic.co/t/extracting-string-from-log-path/284748 "2021-09-21T15:47:03Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@Bkumar](https://discuss.elastic.co/u/Bkumar)
#### Post date: [September 21, 2021, 3:47pm UTC](https://discuss.elastic.co/t/extracting-string-from-log-path/284748/1 "2021-09-21T15:47:03Z")
Hi,
As per requirement, i can't put the tag to filebeat to filter log path at logstash end. So only option left with me to filter the log path on the basis of string.
Here is the sample log path-
/opt/tomcat/instances/dev/HSE/ms-app/log
/opt/tomcat/instances/dev/B07-STAT/service/log
/opt/tomcat/instances/stg/A96-MR/service/log
/opt/tomcar/instances/stg/R2C/service/log
From the above log path, I want to filter the log path which contains the string A96-MR at logstash.
Please help me in filtering on the basis of string.
Thanks
---
### Author:  [@Bkumar](https://discuss.elastic.co/u/Bkumar)
#### Post date: [September 21, 2021, 3:50pm UTC](https://discuss.elastic.co/t/extracting-string-from-log-path/284748/2 "2021-09-21T15:50:53Z")
I tried using regex, but not sure how it will work on logstash
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 21, 2021, 4:34pm UTC](https://discuss.elastic.co/t/extracting-string-from-log-path/284748/3 "2021-09-21T16:34:04Z")
You could try using grok
```
grok { match => { "someField" => "/%{WORD:anotherField}/[^/]+/log$" } }
```
---
### Author:  [@Bkumar](https://discuss.elastic.co/u/Bkumar)
#### Post date: [September 21, 2021, 5:45pm UTC](https://discuss.elastic.co/t/extracting-string-from-log-path/284748/4 "2021-09-21T17:45:00Z")
Thanks @Badger for quick reply
To be more precise, it should be like as per my requirement:
grok { match =\> { "path" =\> "/%{WORD:A96-MR}/[^/]+/logs$" } }
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 21, 2021, 6:21pm UTC](https://discuss.elastic.co/t/extracting-string-from-log-path/284748/5 "2021-09-21T18:21:23Z")
Actually I had that regexp wrong, because WORD does not match hyphen.
```
grok { match => { "path" => "/(?[^/]+)/[^/]+/log$" } }
```
---
### Author:  [@Bkumar](https://discuss.elastic.co/u/Bkumar)
#### Post date: [September 21, 2021, 7:46pm UTC](https://discuss.elastic.co/t/extracting-string-from-log-path/284748/6 "2021-09-21T19:46:51Z")
Hi @Badger I am getting grokparsefailure tag after applying this filter. I am not preety sure about the root cause. Trying to explain use case again
I have almost 30 different log path as a input to logstash and grok need to parse only those path which contains the string "A96-MR" in the log path and send only these log path to output.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 21, 2021, 7:55pm UTC](https://discuss.elastic.co/t/extracting-string-from-log-path/284748/7 "2021-09-21T19:55:56Z")
I tested it in logstash and that grok works if [path] contains "/opt/tomcat/instances/stg/A96-MR/service/log" or any of the other values you show. To drop events where the extracted value is not A96-MR you could check the extracted value
```
if [anotherField] != "A96-MR" { drop {} }
```
If you use
```
output { stdout { codec => rubydebug } }
```
then what does an event look like?
---
### Author:  [@Bkumar](https://discuss.elastic.co/u/Bkumar)
#### Post date: [September 22, 2021, 5:15pm UTC](https://discuss.elastic.co/t/extracting-string-from-log-path/284748/9 "2021-09-22T17:15:57Z")
Hi @Badger
It is working indeed. But we don't want to drop any path. The path which contains A96-MR will go to one table and remaining path will go to other table.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 22, 2021, 5:32pm UTC](https://discuss.elastic.co/t/extracting-string-from-log-path/284748/10 "2021-09-22T17:32:06Z")
OK, so use a conditional in the output section.
---
### Author:  [@Bkumar](https://discuss.elastic.co/u/Bkumar)
#### Post date: [September 22, 2021, 6:30pm UTC](https://discuss.elastic.co/t/extracting-string-from-log-path/284748/11 "2021-09-22T18:30:59Z")
Thanks alot @Badger It worked for me
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 20, 2021, 6:31pm UTC](https://discuss.elastic.co/t/extracting-string-from-log-path/284748/12 "2021-10-20T18:31:16Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.