# Get last folder form path in Logstash

**URL:** <https://discuss.elastic.co/t/get-last-folder-form-path-in-logstash/195991>\
**Category:** Logstash\
**Created:** [August 20, 2019, 7:41pm UTC](https://discuss.elastic.co/t/get-last-folder-form-path-in-logstash/195991 "2019-08-20T19:41:40Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![baselai](https://avatars.discourse-cdn.com/v4/letter/b/ea666f/32.png) [@baselai](https://discuss.elastic.co/u/baselai)\
**Post date:** [August 20, 2019, 7:41pm UTC](https://discuss.elastic.co/t/get-last-folder-form-path-in-logstash/195991/1 "2019-08-20T19:41:40Z")

</div>

I need to extract the name of the last folder in the path where the **file** plugin caught a csv file and then create a field that has the value of the folder, which it is a **taskId** in my case.

Here is an example of what I'm doing, but not sure if this is correct or there's a better way to achieve it

```auto
input {
  file {
    path => "/usr/share/input/**/*.csv"
    start_position => beginning
    sincedb_path => "/dev/null"
    discover_interval => 2
    stat_interval => "1 s"
  }
}

filter {
   grok { match => ["path", "^/[^/]+/[^/]+/[^/]+/[^/]+/(?<taskId>[^/]+)" ] }
}

output {
    stdout { codec => rubydebug }
    file {
        path => "/usr/share/output/output.json"
        codec => "json_lines"
    }
}

```

and here's the output I'm getting:

```auto
{"@timestamp":"2019-08-20T19:35:29.365Z","message":"Sandy,Test text,1.25,f45,3\r","host":"b7ee10dcd65c","@version":"1","path":"/usr/share/input/jobId/134598abcr4_f89/sample.csv","taskId":"134598abcr4_f89"}
{"@timestamp":"2019-08-20T19:35:29.364Z","message":"Mike,Hello,11.5,12A,1\r","host":"b7ee10dcd65c","@version":"1","path":"/usr/share/input/jobId/134598abcr4_f89/sample.csv","taskId":"134598abcr4_f89"}
{"@timestamp":"2019-08-20T19:35:29.364Z","message":"Nicolas,Test Test,0.25,13B,2\r","host":"b7ee10dcd65c","@version":"1","path":"/usr/share/input/jobId/134598abcr4_f89/sample.csv","taskId":"134598abcr4_f89"}
{"@timestamp":"2019-08-20T19:35:29.338Z","message":"user_name,text,size,output,new_column\r","host":"b7ee10dcd65c","@version":"1","path":"/usr/share/input/jobId/134598abcr4_f89/sample.csv","taskId":"134598abcr4_f89"}

```

Maybe there is more generic way to do it, if there's I'd really appreciate the help.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 20, 2019, 8:26pm UTC](https://discuss.elastic.co/t/get-last-folder-form-path-in-logstash/195991/2 "2019-08-20T20:26:48Z")

</div>

I would anchor to the end so that it does not matter what depth in the tree the file is.

```
grok { match => { "path" => "/(?<taskId>[^/]+)/[^/]+$" } }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 18, 2019, 2:10pm UTC](https://discuss.elastic.co/t/get-last-folder-form-path-in-logstash/195991/4 "2019-09-18T14:10:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.