You can use grok to extract a directory name from a path. Examples are here and here. Depending on your versions and ECS compatibility the path of the file will likely be in [path] or, more recently [log][file][path]
2 Likes