How to extract data from filename using logstash?

Elastic Stack Logstash
1

I am using filebeat to monitor a directory for new files that get dropped in every hour. The files are then sent to logstash to be parsed before being sent to ES. The filenames are in this format

aldb-E6-20201015232941.csv or possibly aldbE6-20201015232941.csv

I need to be extract the data aldb and E6 from the filename and add it to the index. Can I do this using logstash?

I know I can get the filepath using [log][file][path] which returns a value like /var/data/filebeat/source/aldb-E6-20201015232941.csv, but how can I then extract the information I need from that?

2

You could do that using grok

grok { match => { "[log][file][path]" => "/(?<firstBit>.{4})(-)?(?<secondBit>.{2})-\d+\.%{WORD}$" } }
3

That works, thanks!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.