Good afternoon.
I would like to know how I could in logstash create a tag (or a custom field) with a part of the value of the log.file.path.keyword field. Considering that this field stores the absolute path, I would be interested in getting only the file name.
I have tried several options, among them the following one, but I can't get this value
The grok pattern looks right, but .keyword is an elasticsearch thing and that field does not exist in logstash. You probably want
match => { "[log][file][path]" => "(?<filename>[a-zA-Z0-9.]*$)" ] }
logstash uses a different syntax to represent objects that have nested fields. It can easily distinguish between [foo.bar] (a field with a dot in its name) and [foo][bar] (and object with a field called bar in it).
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.