I'm trying to do something very simple I think but I fail to understand how it can be done.
So I ask for your help, my setup is the following:
Filebeat sends IIS logs through Logstash towards Elastic. Having also a Kibana and ingest node.
In advance we have loaded the IIS mapping and everything is being mapped perfectly.
I would like to create a mapping that can set the different folders names to different fields that are going to be based on our websites real names.
So for example we have in IIS a website that is named Test Website 1 and if we look at logfilepath it is D:\LogsIIS\W3SVC6\somelognumber.log
I would like to take W3SVC6 from the log file path and map it to a field named Test Website 1