# Ingest node / source name **URL:** \ **Category:** Elasticsearch\ **Created:** [August 20, 2019, 10:47am UTC](https://discuss.elastic.co/t/ingest-node-source-name/195892 "2019-08-20T10:47:10Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![thaideval](https://avatars.discourse-cdn.com/v4/letter/t/a8b319/32.png) [@thaideval](https://discuss.elastic.co/u/thaideval)\ **Post date:** [August 20, 2019, 10:47am UTC](https://discuss.elastic.co/t/ingest-node-source-name/195892/1 "2019-08-20T10:47:10Z")
Hello, i am using filebeat for sending logs to elastic and ingest node for parsing with grok. my logs have 2 fields for datestamp - \> 1/2 is in the name of every file (Year-month-day-hour) and 1/2 is in the beginning of every string (minute-second). Trying to figure how to extract this properly. This is how its now: "grok" : { "field" : "source", "patterns" : [ "%{INT:\_ingest.tempyymmddhh}.log" ] } }, { "set" : { "field" : "\_ingest.tempdate", "value" : "{{\_ingest.tempyymmddhh}}{{\_ingest.tempmm}}{{\_ingest.tempss}}" } }, { "date" : { "field" : "\_ingest.tempdate", "target\_field" : "@timestamp", "formats" : [ "yyMMddHHmmss.SSSSSS" ], but i am getting error: "field [source] not present as part of path [source]" For testing puposes i can set source offset like this "source": "/path/\*/smth.log" But how should i set it for live version with working filebeat and new log files every hour. Any tips? ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [August 20, 2019, 11:30am UTC](https://discuss.elastic.co/t/ingest-node-source-name/195892/2 "2019-08-20T11:30:33Z")
can you provide a sample document and the ingest pipeline so others can reproduce the issue? Also the elasticsearch version you are using would be beneficial to know. Thanks! ---
**Author:** ![thaideval](https://avatars.discourse-cdn.com/v4/letter/t/a8b319/32.png) [@thaideval](https://discuss.elastic.co/u/thaideval)\ **Post date:** [August 20, 2019, 11:48am UTC](https://discuss.elastic.co/t/ingest-node-source-name/195892/3 "2019-08-20T11:48:30Z")
i am using elastic 7.2.0 Unfortunetly I cant provide sample and honestly I dont have problems with parsing(so i supose there is no need in full file. the only problem is how to extract datestamp from filename + string. For example i have filename: 19073122.log (which is year/month/day/hour) and string in file name that starts with: 00:13.375000 (which is minute/second/mlsec) So i know i can put source in offset section. But how should i do that if source changes a lot and it comes from filebeat (7.3.0) ---
**Author:** ![thaideval](https://avatars.discourse-cdn.com/v4/letter/t/a8b319/32.png) [@thaideval](https://discuss.elastic.co/u/thaideval)\ **Post date:** [August 20, 2019, 11:51am UTC](https://discuss.elastic.co/t/ingest-node-source-name/195892/4 "2019-08-20T11:51:33Z")
hmm.. i cant copy full ingest node. its more than 7k characters. and looks like you can upload only image. ---
**Author:** ![thaideval](https://avatars.discourse-cdn.com/v4/letter/t/a8b319/32.png) [@thaideval](https://discuss.elastic.co/u/thaideval)\ **Post date:** [August 20, 2019, 11:54am UTC](https://discuss.elastic.co/t/ingest-node-source-name/195892/5 "2019-08-20T11:54:54Z")
i suppose i can PM you my full node if u ok with it ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [August 20, 2019, 1:45pm UTC](https://discuss.elastic.co/t/ingest-node-source-name/195892/6 "2019-08-20T13:45:05Z")
I'm still not sure I got all the information I need. do you send the information of year/month/day AND minute/second/msec as part of the document or not? ---
**Author:** ![thaideval](https://avatars.discourse-cdn.com/v4/letter/t/a8b319/32.png) [@thaideval](https://discuss.elastic.co/u/thaideval)\ **Post date:** [August 20, 2019, 2:48pm UTC](https://discuss.elastic.co/t/ingest-node-source-name/195892/7 "2019-08-20T14:48:56Z")
I send year/month/day/hour as name of the document and min/sec/msec as start of almost every string in the document ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [August 21, 2019, 6:36am UTC](https://discuss.elastic.co/t/ingest-node-source-name/195892/8 "2019-08-21T06:36:38Z")
so accessing the `_id` plus a field name would be sufficient. Do you happen to have a sample document at hand with a sample id and a sample field that could be used? ---
**Author:** ![thaideval](https://avatars.discourse-cdn.com/v4/letter/t/a8b319/32.png) [@thaideval](https://discuss.elastic.co/u/thaideval)\ **Post date:** [August 21, 2019, 9:45am UTC](https://discuss.elastic.co/t/ingest-node-source-name/195892/9 "2019-08-21T09:45:08Z")
idk abut \_id field. But i think i found an answer! instead of "source" field i started using "log.path" according to [exported-fields](https://www.elastic.co/guide/en/beats/filebeat/current/exported-fields-log.html) and now i am parsing filename correctly. Sorry for inconvenience i caused you. i am just starting to use elastic and not fully understand some things and jargon ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 18, 2019, 9:45am UTC](https://discuss.elastic.co/t/ingest-node-source-name/195892/10 "2019-09-18T09:45:08Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.