### Author:  [@seeva](https://discuss.elastic.co/u/seeva)
#### Post date: [October 25, 2017, 9:29am UTC](https://discuss.elastic.co/t/how-to-know-the-log-comme-from-which-file/105211/1 "2017-10-25T09:29:52Z")
Hi,
I am using filebeat,logstash,ES and kibana 5.6.3. I want to be able to see the log source file name in kibana, but i am not being able to to. i have all information but do not have the file source name , the log are coming from. Please can anyone help me.
In kibana i want a line "file"=\> log-12.01.2000.log for example for each log. here is my logstach conf file.
input {
beats {
port =\> 5044
host =\> "localhost"
}
}
filter {
#(?\[0-9A-F]{10,11})
#%{TIMESTAMP\_ISO8601:FixedFormatISOInternationalDate}
grok {
match =\> { "message" =\> ["(?(\d{4})-(\d{2})-(\d{2}).(\d{2}):(\d{2}):(\d{2}).(\d{3})) %{INT:EventId} %{UUID:ActivityId} %{DATA:UserName} %{NOTSPACE:TransactionIsolationLevel} %{NOTSPACE:TransactionLocalIdentifier} %{NOTSPACE:TransactionDistributedIdentifier} %{NOTSPACE:TransactionStatus} %{NOTSPACE:severity } %{GREEDYDATA:data}"] }
}
mutate {
add\_field =\> {
"[@metadata][Source]" =\> "%{source}"
"[@metadata][Input\_type]" =\> "%{input\_type}"
"[@metadata][Timestamp]" =\> "%{@timestamp}"
"[@metadata][Tags]" =\> "%{tags}"
}
}
mutate {
remove\_field =\> ["message", "source"]
}
}
output {
if "\_grokparsefailure" not in [tags] {
elasticsearch {
hosts =\> ["10.184.161.66","10.184.161.67"]
user =\> elastic
password =\> "Cs\_24Z\*-;u3WXMzwk]66"
codec =\> json
index =\> opera\_index
}
}
}
-- what i have in kibana see attachment.
Thank you.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 25, 2017, 9:57am UTC](https://discuss.elastic.co/t/how-to-know-the-log-comme-from-which-file/105211/2 "2017-10-25T09:57:16Z")
The filename is in the `source` field that you're removing.
---
### Author:  [@seeva](https://discuss.elastic.co/u/seeva)
#### Post date: [October 25, 2017, 10:12am UTC](https://discuss.elastic.co/t/how-to-know-the-log-comme-from-which-file/105211/3 "2017-10-25T10:12:55Z")
Thank you mahnusbaek, i am going to try this. must i delete the index or il will just get update with this field automatically ? thank you.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 25, 2017, 10:41am UTC](https://discuss.elastic.co/t/how-to-know-the-log-comme-from-which-file/105211/4 "2017-10-25T10:41:01Z")
All new events will get the `source` field.
---
### Author:  [@seeva](https://discuss.elastic.co/u/seeva)
#### Post date: [October 25, 2017, 11:35am UTC](https://discuss.elastic.co/t/how-to-know-the-log-comme-from-which-file/105211/5 "2017-10-25T11:35:57Z")
magnusbaeck, i still cannot see the new field named "source", i have restarted the logstash and filebeat services.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 25, 2017, 12:05pm UTC](https://discuss.elastic.co/t/how-to-know-the-log-comme-from-which-file/105211/6 "2017-10-25T12:05:18Z")
Remove all your current filters and use a `stdout { codec => rubydebug }` output to dump all incoming events to the Logstash log. What does an example event look like?
---
### Author:  [@seeva](https://discuss.elastic.co/u/seeva)
#### Post date: [October 25, 2017, 1:11pm UTC](https://discuss.elastic.co/t/how-to-know-the-log-comme-from-which-file/105211/7 "2017-10-25T13:11:41Z")
what do you think about this :
input { stdin { } }
filter {
grok {
match =\> { "message" =\> ["(?(\d{4})-(\d{2})-(\d{2}).(\d{2}):(\d{2}):(\d{2}).(\d{3})) %{INT:EventId} %{UUID:ActivityId} %{DATA:UserName} %{NOTSPACE:TransactionIsolationLevel} %{NOTSPACE:TransactionLocalIdentifier} %{NOTSPACE:TransactionDistributedIdentifier} %{NOTSPACE:TransactionStatus} %{NOTSPACE:severity } %{GREEDYDATA:data}"] }
}
date {
match =\> ["timestamp" , "dd/MMM/yyyy:HH:mm:ss Z"]
}
}
output {
elasticsearch {
hosts =\> ["10.184.161.66","10.184.161.67"]
user =\> elastic
password =\> "Cs\_24Z\*-;u3WXMzwk]66"
index =\> opera\_index
}
stdout { codec =\> rubydebug }
}
here is an event in a log file :
2017-09-05 01:00:08.092 131 00000000-0000-0000-0000-000000000000 user (null) (null) (null) (null) Information this is a message
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 25, 2017, 1:54pm UTC](https://discuss.elastic.co/t/how-to-know-the-log-comme-from-which-file/105211/8 "2017-10-25T13:54:48Z")
Keep your beats input. It's the Filebeat messages we want to look at.
> 2017-09-05 01:00:08.092 131 00000000-0000-0000-0000-000000000000 user (null) (null) (null) (null) Information this is a message
I want to see the messages processed by Logstash, written to the Logstash log. Not the input messages.
---
### Author:  [@seeva](https://discuss.elastic.co/u/seeva)
#### Post date: [October 30, 2017, 9:47am UTC](https://discuss.elastic.co/t/how-to-know-the-log-comme-from-which-file/105211/9 "2017-10-30T09:47:28Z")
Hi magnusbaek, your recommandation of removing "source" in the remove\_field 's line works. I just have to wait some time to see the source field. thank you the problem is resolved.
best.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 27, 2017, 9:48am UTC](https://discuss.elastic.co/t/how-to-know-the-log-comme-from-which-file/105211/10 "2017-11-27T09:48:26Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.