# If path containing some string then field value is "somthing"
**URL:** https://discuss.elastic.co/t/if-path-containing-some-string-then-field-value-is-somthing/184938
**Category:** Logstash
**Created:** [June 10, 2019, 7:31am UTC](https://discuss.elastic.co/t/if-path-containing-some-string-then-field-value-is-somthing/184938 "2019-06-10T07:31:42Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@nitzanm](https://discuss.elastic.co/u/nitzanm)
#### Post date: [June 10, 2019, 7:31am UTC](https://discuss.elastic.co/t/if-path-containing-some-string-then-field-value-is-somthing/184938/1 "2019-06-10T07:31:42Z")
hi
I'm trying to fill a field based on path substring that is coming for filebeat
here's an example for what i tried:
```
input {
beats {
port => 5044
}
}
filter {
if [fields][logtype] == "log4net" {
grok {
match => { message => "(?m)%{TIMESTAMP_ISO8601:sourceTimestamp}\,%{NUMBER:threadid} %{LOGLEVEL:loglevel} %{GREEDYDATA:sourceMessage}" }
}
if [path] =~ "SQLSERVER" {
add_field => { "EXTRACTOR" => "SQLSERVER" }
}
if [path] =~ "ORACLE" {
add_field => { "EXTRACTOR" => "ORACLE" }
}
}
}
output {
elasticsearch {
hosts => "localhost:9200"
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}
```
in this case if the log file path is :
E:\OUM82\TI\_QA\_82\TI\_DS\_FILES\*_ORACLE_\*\_LOGS\ORACLE\_DEMO-ORACLE-OCTIINFA\_107\_30\_05\_2019.log
I want the "extractor" field to be ORACLE
because the path is containing the word ORACLE
TNX.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 10, 2019, 12:57pm UTC](https://discuss.elastic.co/t/if-path-containing-some-string-then-field-value-is-somthing/184938/2 "2019-06-10T12:57:37Z")
If your events have a [path] field then I would expect that to work. If it does not work then that suggests your events do not have a [path] field. What do you get for an event from
```
output { stdout { codec => rubydebug } }
```
---
### Author:  [@nitzanm](https://discuss.elastic.co/u/nitzanm)
#### Post date: [June 10, 2019, 7:22pm UTC](https://discuss.elastic.co/t/if-path-containing-some-string-then-field-value-is-somthing/184938/3 "2019-06-10T19:22:05Z")
> [@Badger](#):
>
> output { stdout { codec =\> rubydebug } }
```
"log" => {
"offset" => 18109,
"file" => {
"path" => "E:\\OUM82\\TI_QA_82\\TI_DS_FILES\\ORACLE_LOGS\\ORACLE_DEMO-ORACLE-OCTIINFA_107_30_05_2019 - Copy.
log"
}
},
"host" => {
"name" => "OctQa",
"os" => {
"family" => "windows",
"kernel" => "10.0.14393.2969 (rs1_release.190503-1820)",
"build" => "14393.2969",
"platform" => "windows",
"name" => "Windows Server 2016 Datacenter",
"version" => "10.0"
},
"hostname" => "OctQa",
"architecture" => "x86_64",
"id" => "67d6abee-cd05-4497-a3b8-eaacbf4403dc"
},
"input" => {
"type" => "log"
},
"loglevel" => "INFO",
"sourceMessage" => "[1] ExtractorLogger Octopai.Desktop.Extractors.OracleExtractor SaveMetaDataQueryResult - Done
executing delete on table: TI.SHD_DB_UI_OBJECT_DETAILS for conectionID: 107 . result: Successful"
}
```
I can see the path field..
bat i probably missing something, because I can't make this work..
tnx.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 10, 2019, 9:32pm UTC](https://discuss.elastic.co/t/if-path-containing-some-string-then-field-value-is-somthing/184938/4 "2019-06-10T21:32:03Z")
You can refer to that as [log][file][path], not [path].
---
### Author:  [@nitzanm](https://discuss.elastic.co/u/nitzanm)
#### Post date: [June 11, 2019, 4:30pm UTC](https://discuss.elastic.co/t/if-path-containing-some-string-then-field-value-is-somthing/184938/5 "2019-06-11T16:30:36Z")
tnx..
it's working now..
you are the man Badger!!
pb:
in my example mutate inside the if is missing
```
if [fields][logtype] == "log4net" {
grok {
match => { message => "(?m)%{TIMESTAMP_ISO8601:sourceTimestamp}\,%{NUMBER:threadid} %{LOGLEVEL:loglevel} %{GREEDYDATA:sourceMessage}" }
}
if [log][file][path] =~ "SQLSERVER" {
mutate { add_field => { "extractor" => "SQLSERVER" }}
} else if [log][file][path] =~ "ORACLE" {
mutate { add_field => { "extractor" => "ORACLE" }}
} else if [log][file][path] =~ "INFAORA" {
mutate { add_field => { "extractor" => "INFAORA" }}
}else if [log][file][path] =~ "ODI" {
mutate { add_field => { "extractor" => "ODI" }}
}else if [log][file][path] =~ "POWERBI" {
mutate { add_field => { "extractor" => "POWERBI" }}
}else if [log][file][path] =~ "SSAS" {
mutate { add_field => { "extractor" => "SSAS" }}
}else if [log][file][path] =~ "SSIS" {
mutate { add_field => { "extractor" => "SSIS" }}
}else if [log][file][path] =~ "SSISSqlServer" {
mutate { add_field => { "extractor" => "SSISSqlServer" }}
}else if [log][file][path] =~ "SSRS" {
mutate { add_field => { "extractor" => "SSRS" }}
}else if [log][file][path] =~ "TABULAR" {
mutate { add_field => { "extractor" => "TABULAR" }}
}else if [log][file][path] =~ "TERADATA" {
mutate { add_field => { "extractor" => "TERADATA" }}
}
}
```
tnx again
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 9, 2019, 4:30pm UTC](https://discuss.elastic.co/t/if-path-containing-some-string-then-field-value-is-somthing/184938/6 "2019-07-09T16:30:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.