# I want to add a field with filename
**URL:** https://discuss.elastic.co/t/i-want-to-add-a-field-with-filename/114049
**Category:** Logstash
**Created:** [January 4, 2018, 9:25am UTC](https://discuss.elastic.co/t/i-want-to-add-a-field-with-filename/114049 "2018-01-04T09:25:08Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@Asier\_Saluena](https://discuss.elastic.co/u/Asier_Saluena)
#### Post date: [January 4, 2018, 9:25am UTC](https://discuss.elastic.co/t/i-want-to-add-a-field-with-filename/114049/1 "2018-01-04T09:25:08Z")
Hi you all, i'm starting a project with elk stack and we have few domains working on the same machine, which sends his apache logs to elk. I want to extract the filename to filter by this field on kibana.
I'm trying something like the following code:
> ```
> filter {
> if [type] == "apache-access" {
> grok {
> match => { "message" => "%{COMBINEDAPACHELOG}" }
> match => { "message" => "%{GREEDYDATA}/%{GREEDYDATA:filename}\.es_access_log"}
> }
> mutate {
> remove_field => ["message"]
> }
> }
> }
>
> ```
When I look at Kibana I find out that I have a field called source which contains whole path to the file but It's impossible to me to extract filename from here
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 6, 2018, 10:25am UTC](https://discuss.elastic.co/t/i-want-to-add-a-field-with-filename/114049/2 "2018-01-06T10:25:04Z")
Grok filters stop evaluating expressions when they get a match, so if the COMBINEDAPACHELOG expression matches the other one won't be tried at all. Secondly, if the file path is stored in the `source` field you obviously need to tell the grok filter to match _that_ field and not `message`.
---
### Author:  [@Asier\_Saluena](https://discuss.elastic.co/u/Asier_Saluena)
#### Post date: [January 8, 2018, 7:54am UTC](https://discuss.elastic.co/t/i-want-to-add-a-field-with-filename/114049/3 "2018-01-08T07:54:44Z")
So, I have to apply another grok filter for this document-type, is this correct?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 8, 2018, 8:20am UTC](https://discuss.elastic.co/t/i-want-to-add-a-field-with-filename/114049/4 "2018-01-08T08:20:38Z")
Yes.
---
### Author:  [@Asier\_Saluena](https://discuss.elastic.co/u/Asier_Saluena)
#### Post date: [January 8, 2018, 8:59am UTC](https://discuss.elastic.co/t/i-want-to-add-a-field-with-filename/114049/5 "2018-01-08T08:59:13Z")
Thanks for your help, I´m gonna try it.
---
### Author:  [@Asier\_Saluena](https://discuss.elastic.co/u/Asier_Saluena)
#### Post date: [January 12, 2018, 7:57am UTC](https://discuss.elastic.co/t/i-want-to-add-a-field-with-filename/114049/6 "2018-01-12T07:57:32Z")
I have been doing tests during this week with this configuration and still does not show the filename, I dont know why is it incorrect.
First config file:
> ```
> filter {
> if [type] == "apache-access" {
> grok {
> match => { "message" => "%{COMBINEDAPACHELOG}" }
> }
> mutate {
> remove_field => ["message"]
> }
> geoip {
> source => "clientip"
> }
> }
> }
>
> ```
Second config file:
> ```
> filter {
> if [%{host}] == "***" {
> grok {
> match => { "source" => "%{GREEDYDATA}/%{GREEDYDATA:filename}\.es_access_log"}
> }
> }
> }
>
> ```
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 18, 2018, 9:56pm UTC](https://discuss.elastic.co/t/i-want-to-add-a-field-with-filename/114049/7 "2018-01-18T21:56:27Z")
> ```
> if [%{host}] == "***" {
>
> ```
`[host]`, not `[%{host}]`. I assume "\*\*\*" is your way of censoring the hostname.
---
### Author:  [@Asier\_Saluena](https://discuss.elastic.co/u/Asier_Saluena)
#### Post date: [January 24, 2018, 7:53am UTC](https://discuss.elastic.co/t/i-want-to-add-a-field-with-filename/114049/8 "2018-01-24T07:53:06Z")
Thanks! Now is working properly.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 21, 2018, 7:53am UTC](https://discuss.elastic.co/t/i-want-to-add-a-field-with-filename/114049/9 "2018-02-21T07:53:32Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.