Ingest Pipeline, set field derived from another


i am currently building a new pipeline for filebeat where we ingest a lot of different logfiles, e.g.

  • /log/appname1.log
  • /log/appname2.log
  • etc

now i want a field in every document that says:

  • app: appname1

So, is it possible to parse an existing field (log.file.path: /log/appname1.log) with an regex and use the result in a new field?


You can use the grok processor for that: Grok processor | Elasticsearch Reference [7.11] | Elastic

You can use the Kibana grok debugger(available under Dev Tools) to test your pattern.

Best regards

great, it works quite well for me


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.