# Grok and match windows path

**URL:** <https://discuss.elastic.co/t/grok-and-match-windows-path/183560>\
**Category:** Logstash\
**Created:** [May 30, 2019, 2:56pm UTC](https://discuss.elastic.co/t/grok-and-match-windows-path/183560 "2019-05-30T14:56:37Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sam\_Kisada](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sam_kisada/32/44452_2.png) [@Sam\_Kisada](https://discuss.elastic.co/u/Sam_Kisada)\
**Post date:** [May 30, 2019, 2:56pm UTC](https://discuss.elastic.co/t/grok-and-match-windows-path/183560/1 "2019-05-30T14:56:37Z")

</div>

Hi.  
I have some troubles with matching path to field  
here is path in table:  
` log.file.path	C:\Program Files\1cv8\srvinfo\reg_1541\d3367601-19f9-4ad2-afa0-078939886fc5\1Cv8Log\20190217000000.lgp`  
in json it looks like:  
`C:\\Program Files\\1cv8\\srvinfo\\reg_1541\\4cd3c2be-4872-4058-a877-fff0cf9958e7\\1Cv8Log\\20190529150000.lgp`

So I try match it by string  
`match=> { "path" => "%{GREEDYDATA}\\reg_1541\\%{DATA:base_id}\\1Cv8Log*"}`

I tried this patterns in grok debugger:

> %{GREEDYDATA}\reg\_1541\%{DATA:base\_id}\1Cv8Log\*  
> %{GREEDYDATA}\\reg\_1541\\%{DATA:base\_id}\\1Cv8Log\*  
> C:\Program Files\1cv8\srvinfo\reg\_1541\%{DATA:base\_id}\1Cv8Log  
> %{GREEDYDATA}\reg\_1541\%{DATA:base\_id}\1Cv8Log  
> %{GREEDYDATA}\\reg\_1541\\%{DATA:base\_id}\\1Cv8Log

and they ok, but logstash doesnt create field base\_id  
Help me pls

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 30, 2019, 4:24pm UTC](https://discuss.elastic.co/t/grok-and-match-windows-path/183560/2 "2019-05-30T16:24:01Z")

</div>

Using

```
input { generator { count => 1 lines => [''] } }
filter {
    mutate { add_field => { "[path]" => "C:\Program Files\1cv8\srvinfo\reg_1541\d3367601-19f9-4ad2-afa0-078939886fc5\1Cv8Log\20190217000000.lgp" } }
    grok { match=> { "path" => "%{GREEDYDATA}\\reg_1541\\%{DATA:base_id}\\1Cv8Log*" } }
}
output { stdout { codec => rubydebug { metadata => false } } }

```

I get

```
   "base_id" => "d3367601-19f9-4ad2-afa0-078939886fc5",

```

So something is not as you describe it.

Note that there is no implicit anchoring of grok patterns, so you do not need the leading %{GREEDYDATA}.

---

<div class="post-metadata">

**Author:** ![Sam\_Kisada](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sam_kisada/32/44452_2.png) [@Sam\_Kisada](https://discuss.elastic.co/u/Sam_Kisada)\
**Post date:** [May 31, 2019, 6:08am UTC](https://discuss.elastic.co/t/grok-and-match-windows-path/183560/3 "2019-05-31T06:08:45Z")

</div>

> So something is not as you describe it.

You are right, mutate is missed:

> [@Badger](#):
>
> mutate { add\_field =\>

but I already have this field in doc :

> log.file.path C:\Program Files\1cv8\srvinfo\reg\_1541\f11cbea7-7da0-42a2-852c-05792caa0a7b\1Cv8Log\20190501000000.lgp`

How can i parse it?  
seems [that guy](https://discuss.elastic.co/t/match-log-file-path-in-grok/177682) stuck in same place

but in my case this works fine:

> match=\> { "[log][file][path]" =\> "%{GREEDYDATA}\reg\_1541\%{DATA:base\_id}\1Cv8Log"}

thanks for help

---

<div class="post-metadata">

**Author:** ![Gelinski](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gelinski/32/142412_2.png) [@Gelinski](https://discuss.elastic.co/u/Gelinski)\
**Post date:** [June 2, 2019, 5:04am UTC](https://discuss.elastic.co/t/grok-and-match-windows-path/183560/4 "2019-06-02T05:04:36Z")

</div>

> [@Sam\_Kisada](#):
>
> match=\> { "[log][file][path]" =\> "%{GREEDYDATA}\reg\_1541%{DATA:base\_id}\1Cv8Log"}

it works for me as well

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 30, 2019, 5:04am UTC](https://discuss.elastic.co/t/grok-and-match-windows-path/183560/5 "2019-06-30T05:04:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.