So something is not as you describe it.
You are right, mutate is missed:
but I already have this field in doc :
log.file.path C:\Program Files\1cv8\srvinfo\reg_1541\f11cbea7-7da0-42a2-852c-05792caa0a7b\1Cv8Log\20190501000000.lgp`
How can i parse it?
seems that guy stuck in same place
but in my case this works fine:
match=> { "[log][file][path]" => "%{GREEDYDATA}\reg_1541\%{DATA:base_id}\1Cv8Log"}
thanks for help