# How to extract data from filename using logstash?

**URL:** https://discuss.elastic.co/t/how-to-extract-data-from-filename-using-logstash/257371
**Category:** Logstash
**Created:** [December 2, 2020, 2:56pm UTC](https://discuss.elastic.co/t/how-to-extract-data-from-filename-using-logstash/257371 "2020-12-02T14:56:02Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![reillye](https://avatars.discourse-cdn.com/v4/letter/r/c6cbf5/32.png) [@reillye](https://discuss.elastic.co/u/reillye)
#### Post date: [December 2, 2020, 2:56pm UTC](https://discuss.elastic.co/t/how-to-extract-data-from-filename-using-logstash/257371/1 "2020-12-02T14:56:02Z")

</div>

I am using filebeat to monitor a directory for new files that get dropped in every hour. The files are then sent to logstash to be parsed before being sent to ES. The filenames are in this format

`aldb-E6-20201015232941.csv` or possibly `aldbE6-20201015232941.csv`

I need to be extract the data `aldb` and `E6` from the filename and add it to the index. Can I do this using logstash?

I know I can get the filepath using `[log][file][path]` which returns a value like `/var/data/filebeat/source/aldb-E6-20201015232941.csv`, but how can I then extract the information I need from that?

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 2, 2020, 4:04pm UTC](https://discuss.elastic.co/t/how-to-extract-data-from-filename-using-logstash/257371/2 "2020-12-02T16:04:20Z")

</div>

You could do that using grok

```
grok { match => { "[log][file][path]" => "/(?<firstBit>.{4})(-)?(?<secondBit>.{2})-\d+\.%{WORD}$" } }
```

---

<div class="post-metadata">

### Author: ![reillye](https://avatars.discourse-cdn.com/v4/letter/r/c6cbf5/32.png) [@reillye](https://discuss.elastic.co/u/reillye)
#### Post date: [December 2, 2020, 4:46pm UTC](https://discuss.elastic.co/t/how-to-extract-data-from-filename-using-logstash/257371/3 "2020-12-02T16:46:30Z")

</div>

That works, thanks!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 30, 2020, 4:46pm UTC](https://discuss.elastic.co/t/how-to-extract-data-from-filename-using-logstash/257371/4 "2020-12-30T16:46:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.