Help for mapping a field based on a log file path location

Elastic Stack Elasticsearch
1

Hello,

I'm trying to do something very simple I think but I fail to understand how it can be done.
So I ask for your help, my setup is the following:
Filebeat sends IIS logs through Logstash towards Elastic. Having also a Kibana and ingest node.
In advance we have loaded the IIS mapping and everything is being mapped perfectly.

I would like to create a mapping that can set the different folders names to different fields that are going to be based on our websites real names.
So for example we have in IIS a website that is named Test Website 1 and if we look at logfilepath it is D:\LogsIIS\W3SVC6\somelognumber.log
I would like to take W3SVC6 from the log file path and map it to a field named Test Website 1

Thank you.

2

Alright this can be marked as solved, we added the cs-host field on the IIS side and then after just grok-ed the new field and all is perfect.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.