How to set the [id] field to value of [path] field (input-file)

[Tao_Zhang (Tao.Z)]

My GOAL:
I want set id to managementID like below when input a file:

Ex.
input-file-path: \servername*\managementID*\input-file.txt

The managementID is a unique value and I want update the file by this ID.
Maybe set id to (the part of) input-file-path is a way to Achieve my goal. Is it possible?

If there is a better way to do it , please teach me.

Best regards.

[jakommo (Jakob Reiter)]

Hi @Tao_Zhang,

my understanding is that you want to parse out the managementID from the path of the files, correct?

You could use a grok filter like the following, to just parse the ID and create a new field with that ID.
E.g.
LS config:

input {
  file {
path => "/logs/managementID*/*.log"
  }
}

filter {
  grok {
match => [ "path", "%{NOTSPACE}/managementID%{INT:managementID}/%{NOTSPACE}"]
  }
}

output {
  stdout { codec => rubydebug }
}

This would create events like:

{
            "path" => "/logs/managementID123/example.log",
      "@timestamp" => 2016-12-20T14:21:30.131Z,
    "managementID" => "123",
        "@version" => "1",
            "host" => "es-jre",
         "message" => "test2",
            "tags" => []
}
{
            "path" => "/logs/managementID456/example.log",
      "@timestamp" => 2016-12-20T14:21:30.154Z,
    "managementID" => "456",
        "@version" => "1",
            "host" => "es-jre",
         "message" => "test1",
            "tags" => []
}

With "managementID" => "123" and "managementID" => "456" parsed from the files path.

and I want update the file by this ID.

I'm just not sure what you mean by that? Can you provide more details?

/jakob