# Filebeat Dynamic Output File Path Configuration Issue
**URL:** https://discuss.elastic.co/t/filebeat-dynamic-output-file-path-configuration-issue/382871
**Category:** Beats
**Tags:** filebeat
**Created:** [October 22, 2025, 5:43am UTC](https://discuss.elastic.co/t/filebeat-dynamic-output-file-path-configuration-issue/382871 "2025-10-22T05:43:47Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@jiwanging](https://discuss.elastic.co/u/jiwanging)
#### Post date: [October 22, 2025, 5:43am UTC](https://discuss.elastic.co/t/filebeat-dynamic-output-file-path-configuration-issue/382871/1 "2025-10-22T05:43:47Z")
I'm trying to configure Filebeat to dynamically output files to paths and filenames that map to the original source paths and filenames. For example:
Source path to collect: /root/filebeat/log/source\_log/\*.log
Desired output path: /root/filebeat/log\_files/source\_log/, with the filename remaining the same as the original.
The idea is to retrieve the path from the event, process it, add a custom field to the environment, and then reference this variable in output.file. However, during testing, the variable values are not being read correctly. The output directly uses the variable name as a string, and logs indicate that the output filename is initialized before data collection begins.
I'd like to ask: Does Filebeat support dynamic configuration of output paths? If so, how should it be configured correctly?
Here is my test configuration:
＜
```auto
filebeat.inputs:
- type: filestream
enabled: true
id: app-logs
paths: \["/root/filebeat/log/source_log/\*.log"\]
processors:
- script:
lang: javascript
id: path_rewriter
source: |
function process(event) {
// 1. Get the complete path of the original log file
var originalLogPath = event.Get("log.file.path");
if (!originalLogPath) {
return; // Skip processing if no path information
}
var pathArray = originalLogPath.split('/');
// Target the position before the second-to-last element in the path array
var insertIndex = pathArray.length - 2;
// Use splice to insert the new directory 'log_files' before that position
pathArray.splice(insertIndex, 0, 'log_files');
event.Put("custom_rewritten_file", pathArray[pathArray.length-1]); // Set the filename
var pathArrayWithoutLast = pathArray.slice(0, -1); // Remove the last element (filename)
var newOutputPath = pathArrayWithoutLast.join('/'); // Rejoin into a path string
event.Put("custom_rewritten_path", newOutputPath); // Set the custom path
}
logging.level: debug
output.file:
path: '/tmp/filebeat_test/%{\[custom_rewritten_path\]}' # Try to use the custom path variable
filename: '%{\[custom_rewritten_file\]}' # Try to use the custom filename variable
permissions: 0644
create_parents: true
codec.format:
string: '%{\[custom_rewritten_file\]} %{\[message\]}'
```
The main issue is that the output uses the literal string %{[custom\_rewritten\_path]}and %{[custom\_rewritten\_file]}instead of their values. Logs suggest the output filename is determined very early, before event processing. Any insights or correct configuration examples would be greatly appreciated.
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [October 22, 2025, 12:39pm UTC](https://discuss.elastic.co/t/filebeat-dynamic-output-file-path-configuration-issue/382871/2 "2025-10-22T12:39:44Z")
> [@jiwanging](#):
>
> ```auto
> output.file:
> path: '/tmp/filebeat_test/%{\[custom_rewritten_path\]}' # Try to use the custom path variable
> filename: '%{\[custom_rewritten_file\]}' # Try to use the custom filename variable
> permissions: 0644
> create_parents: true
> codec.format:
> string: '%{\[custom_rewritten_file\]} %{\[message\]}'
>
> ```
I don't think you should escape the `[` and `]`, this is basically saying that the field name contains a literal `[` and `]`.
Try to use just `%{[custom_rewritten_path]}` and the same for the other fields.
Also, your input can be just this:
```auto
- type: filestream
enabled: true
id: app-logs
paths:
- "/root/filebeat/log/source_log/*.log"
```
---
### Author:  [@dot-mike](https://discuss.elastic.co/u/dot-mike)
#### Post date: [November 4, 2025, 8:57pm UTC](https://discuss.elastic.co/t/filebeat-dynamic-output-file-path-configuration-issue/382871/3 "2025-11-04T20:57:09Z")
Hi. Your filebeat configuration looks like AI generated code. For example `create_parents` IS NOT valid config reference to the key `output.file`. You can view the full config reference here for filebeat: [filebeat.reference.yml | Beats](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-reference-yml)
Secondly, filename does not support string interpolation, only `path` does : [beats/libbeat/outputs/fileout/config.go at 4ded660aa9fc59fc919e9d2f54f8d476e570ef04 · elastic/beats · GitHub](https://github.com/elastic/beats/blob/4ded660aa9fc59fc919e9d2f54f8d476e570ef04/libbeat/outputs/fileout/config.go#L29)
And since we already access to path variable, it's just matter of extracting the filename. We can create a directory to be the filename and store a generic filename in the directory. This is a workaround.
For example, if the log file is "prod.log" it will give the following path as output:
`/tmp/filebeat\_test/prod.log/output.log'
Following config is untested and may or may not work!
```auto
filebeat.inputs:
- type: filestream
enabled: true
id: app-logs
paths:
- /root/filebeat/log/source_log/*.log
processors:
- dissect:
tokenizer: "%{}/%{original_file_name}"
field: "log.file.path"
target_prefix: ""
output.file:
path: "/tmp/filebeat_test/%{[original_file_name]}"
filename: 'output.log'
permissions: 0644
codec.format:
string: "%{[original_file_name]} %{[message]}"
```
And word of advice, don't use AI. It's not a magic black 8-ball that give the solution to your problems. It's not a search engine, it's not a crystal ball. It's just a fancy autocomplete tool that will insert what ever it sees fit best.