# Grok and match windows path

**URL:** https://discuss.elastic.co/t/grok-and-match-windows-path/183560
**Category:** Logstash
**Created:** [May 30, 2019, 2:56pm UTC](https://discuss.elastic.co/t/grok-and-match-windows-path/183560 "2019-05-30T14:56:37Z")
**Posts on this page:** 1
**Showing post:** 3

<div class="post-metadata">

### Author: ![Sam\_Kisada](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sam_kisada/32/44452_2.png) [@Sam\_Kisada](https://discuss.elastic.co/u/Sam_Kisada)
#### Post date: [May 31, 2019, 6:08am UTC](https://discuss.elastic.co/t/grok-and-match-windows-path/183560/3 "2019-05-31T06:08:45Z")

</div>

> So something is not as you describe it.

You are right, mutate is missed:

> [@Badger](#):
>
> mutate { add\_field =\>

but I already have this field in doc :

> log.file.path C:\Program Files\1cv8\srvinfo\reg\_1541\f11cbea7-7da0-42a2-852c-05792caa0a7b\1Cv8Log\20190501000000.lgp`

How can i parse it?  
seems [that guy](https://discuss.elastic.co/t/match-log-file-path-in-grok/177682) stuck in same place

but in my case this works fine:

> match=\> { "[log][file][path]" =\> "%{GREEDYDATA}\reg\_1541\%{DATA:base\_id}\1Cv8Log"}

thanks for help

---

_[View the full topic](https://discuss.elastic.co/t/grok-and-match-windows-path/183560)._