# Filebeat field depending on Path

**URL:** <https://discuss.elastic.co/t/filebeat-field-depending-on-path/116480>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 22, 2018, 12:18pm UTC](https://discuss.elastic.co/t/filebeat-field-depending-on-path/116480 "2018-01-22T12:18:45Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![OptiFine](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/optifine/32/26790_2.png) [@OptiFine](https://discuss.elastic.co/u/OptiFine)\
**Post date:** [January 22, 2018, 12:18pm UTC](https://discuss.elastic.co/t/filebeat-field-depending-on-path/116480/1 "2018-01-22T12:18:46Z")

</div>

Hi,

I am trying to add a specific field which will be varying depending on path.

I have logs coming from 6 different environment respectively 'prod', '101', '102', '201', '202', '301'. It is planned to add an other one soon so I would like to do something abstract.

I would like to generate automatically a field by extracting the information from the path.

Ex:

> paths : /var/log/prod/App/app.log

And my fields would be :

> fields: { env: prod}

I don't know how I can do that and if it is possible.

Some help ? Thanks in advance.

---

<div class="post-metadata">

**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\
**Post date:** [January 22, 2018, 3:36pm UTC](https://discuss.elastic.co/t/filebeat-field-depending-on-path/116480/2 "2018-01-22T15:36:08Z")

</div>

Hello @OptiFine,

It's not currently possible in Filebeat to do that; we do have the internal discussion to add a way to extract information or fields to events but no clear short-term plan.

But, you could send your events to an [ingest pipeline](https://www.elastic.co/guide/en/elasticsearch/reference/master/ingest.html) and use the [grok processor](https://www.elastic.co/guide/en/elasticsearch/reference/master/grok-processor.html) to extract that information? Each event has the original file, so you use that as the target field.

Thanks

---

<div class="post-metadata">

**Author:** ![OptiFine](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/optifine/32/26790_2.png) [@OptiFine](https://discuss.elastic.co/u/OptiFine)\
**Post date:** [January 22, 2018, 4:36pm UTC](https://discuss.elastic.co/t/filebeat-field-depending-on-path/116480/3 "2018-01-22T16:36:35Z")

</div>

Hi Pierhugues,

You're right it might be a good idea to use a grok filter in my logstash... I will see if the idea is approved by the team !

Thanks for your answer !

---

<div class="post-metadata">

**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\
**Post date:** [January 22, 2018, 4:40pm UTC](https://discuss.elastic.co/t/filebeat-field-depending-on-path/116480/4 "2018-01-22T16:40:04Z")

</div>

Yes logstash would also work!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 19, 2018, 4:40pm UTC](https://discuss.elastic.co/t/filebeat-field-depending-on-path/116480/5 "2018-02-19T16:40:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.