# How to get part of the path name and add it to the index

**URL:** <https://discuss.elastic.co/t/how-to-get-part-of-the-path-name-and-add-it-to-the-index/47547>\
**Category:** Logstash\
**Created:** [April 16, 2016, 1:03am UTC](https://discuss.elastic.co/t/how-to-get-part-of-the-path-name-and-add-it-to-the-index/47547 "2016-04-16T01:03:52Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![subbu.nv](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@subbu.nv](https://discuss.elastic.co/u/subbu.nv)\
**Post date:** [April 16, 2016, 1:03am UTC](https://discuss.elastic.co/t/how-to-get-part-of-the-path-name-and-add-it-to-the-index/47547/1 "2016-04-16T01:03:52Z")

</div>

0  
down vote  
favorite  
I currently have a file name like this. [SERIALNUMBER][2014\_12\_04][00\_45\_22][141204T014214]AB\_DEF.log

i basically want to extract the year from the file (2014) and add it to the index name in logstash conf file.logstash.conf Below is my conf file.

input {  
file {  
path =\> "C:/ABC/DEF/HJK/LOGS/\*\*/\*"  
start\_position =\> beginning  
type =\> syslog  
}  
}  
filter {

```
grok {
    match => { "message" => "%{COMBINEDAPACHELOG}"}
}

```

}

output {  
elasticsearch {  
index =\> "type1logs"  
}  
stdout {}  
}

Please help. thanks

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 16, 2016, 8:28pm UTC](https://discuss.elastic.co/t/how-to-get-part-of-the-path-name-and-add-it-to-the-index/47547/2 "2016-04-16T20:28:55Z")

</div>

I'm not sure there is a way to do this. There is no timestamp in the file?

---

<div class="post-metadata">

**Author:** ![subbu.nv](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@subbu.nv](https://discuss.elastic.co/u/subbu.nv)\
**Post date:** [April 16, 2016, 8:51pm UTC](https://discuss.elastic.co/t/how-to-get-part-of-the-path-name-and-add-it-to-the-index/47547/3 "2016-04-16T20:51:21Z")

</div>

the time stamp is saved in different format "[2014\_12\_04][00\_45\_22]".  
but is there a way to capture the current indexing time stamp and extract only the year , add it to the index?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 16, 2016, 9:01pm UTC](https://discuss.elastic.co/t/how-to-get-part-of-the-path-name-and-add-it-to-the-index/47547/4 "2016-04-16T21:01:24Z")

</div>

Yes, use the date filter - [https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html)

---

<div class="post-metadata">

**Author:** ![subbu.nv](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@subbu.nv](https://discuss.elastic.co/u/subbu.nv)\
**Post date:** [April 18, 2016, 10:45pm UTC](https://discuss.elastic.co/t/how-to-get-part-of-the-path-name-and-add-it-to-the-index/47547/5 "2016-04-18T22:45:18Z")

</div>

thanks a lot for your help.

in the output section, i used like below and it is giving results as expected. i didnt add the date filter though.

output {  
elasticsearch {  
index =\> "%{+YYYY}\_lsclient08"  
}  
stdout {}  
}

YYYY is getting replaced with the current year 2016

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 19, 2016, 6:05am UTC](https://discuss.elastic.co/t/how-to-get-part-of-the-path-name-and-add-it-to-the-index/47547/6 "2016-04-19T06:05:31Z")

</div>

You need a date filter if you want the "%{+YYYY}" to be replaced by the event's year field rather than the current year.

---

<div class="post-metadata">

**Author:** ![subbu.nv](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@subbu.nv](https://discuss.elastic.co/u/subbu.nv)\
**Post date:** [April 20, 2016, 6:34pm UTC](https://discuss.elastic.co/t/how-to-get-part-of-the-path-name-and-add-it-to-the-index/47547/7 "2016-04-20T18:34:11Z")

</div>

ok thanks a lot, it works.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:01am UTC](https://discuss.elastic.co/t/how-to-get-part-of-the-path-name-and-add-it-to-the-index/47547/8 "2017-07-06T05:01:23Z")

</div>