# Help for mapping a field based on a log file path location

**URL:** <https://discuss.elastic.co/t/help-for-mapping-a-field-based-on-a-log-file-path-location/276777>\
**Category:** Elasticsearch\
**Created:** [June 23, 2021, 10:58am UTC](https://discuss.elastic.co/t/help-for-mapping-a-field-based-on-a-log-file-path-location/276777 "2021-06-23T10:58:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sakrayaami](https://avatars.discourse-cdn.com/v4/letter/s/dec6dc/32.png) [@sakrayaami](https://discuss.elastic.co/u/sakrayaami)\
**Post date:** [June 23, 2021, 10:58am UTC](https://discuss.elastic.co/t/help-for-mapping-a-field-based-on-a-log-file-path-location/276777/1 "2021-06-23T10:58:59Z")

</div>

Hello,

I'm trying to do something very simple I think but I fail to understand how it can be done.  
So I ask for your help, my setup is the following:  
Filebeat sends IIS logs through Logstash towards Elastic. Having also a Kibana and ingest node.  
In advance we have loaded the IIS mapping and everything is being mapped perfectly.

I would like to create a mapping that can set the different folders names to different fields that are going to be based on our websites real names.  
So for example we have in IIS a website that is named Test Website 1 and if we look at logfilepath it is D:\LogsIIS\W3SVC6\somelognumber.log  
I would like to take W3SVC6 from the log file path and map it to a field named Test Website 1

Thank you.

---

<div class="post-metadata">

**Author:** ![sakrayaami](https://avatars.discourse-cdn.com/v4/letter/s/dec6dc/32.png) [@sakrayaami](https://discuss.elastic.co/u/sakrayaami)\
**Post date:** [June 24, 2021, 2:24pm UTC](https://discuss.elastic.co/t/help-for-mapping-a-field-based-on-a-log-file-path-location/276777/2 "2021-06-24T14:24:47Z")

</div>

Alright this can be marked as solved, we added the cs-host field on the IIS side and then after just grok-ed the new field and all is perfect.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 22, 2021, 2:25pm UTC](https://discuss.elastic.co/t/help-for-mapping-a-field-based-on-a-log-file-path-location/276777/3 "2021-07-22T14:25:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
