# Logging form folder with subfolders

**URL:** <https://discuss.elastic.co/t/logging-form-folder-with-subfolders/95907>\
**Category:** Logstash\
**Created:** [August 4, 2017, 3:03pm UTC](https://discuss.elastic.co/t/logging-form-folder-with-subfolders/95907 "2017-08-04T15:03:45Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alex\_Kovalyov](https://avatars.discourse-cdn.com/v4/letter/a/b5e925/32.png) [@Alex\_Kovalyov](https://discuss.elastic.co/u/Alex_Kovalyov)\
**Post date:** [August 4, 2017, 3:03pm UTC](https://discuss.elastic.co/t/logging-form-folder-with-subfolders/95907/1 "2017-08-04T15:03:45Z")

</div>

Hello!  
I have the next structure of logs  
/var/log/stash/site1/_.log  
/var/log/stash/site1/accounts/account1/_.log  
/var/log/stash/site1/otherKind1/_.log  
/var/log/stash/site1/otherKind2/_.log  
so in site can be many subfolders  
same site2, site3 etc

How I should use filter grok or others to get in elasticsearch output in index all this subfolders: site1,2,3 (name of sites here), "accounts" and then account names  
%{site}  
%{site}-%{kind}  
%{site}-account-%{account}

Trying to do like this:  
input {  
file {  
path =\> ["/var/log/stash/\*\*/_.log"]  
type =\> "file"  
}  
}  
filter {  
grok {  
match =\> {"path" =\> "/var/log/stash/(?[^/]+)/(?[^/]+)/_.log"}  
}  
grok {  
match =\> {"path" =\> "/var/log/stash/(?[^/]+)/\*.log" }  
}  
...  
}  
output {  
if [type] == "file" {  
elasticsearch {  
hosts =\> "127.0.0.1:9200"  
index =\> "logstash-%{site}-%{kind}-%{+YYYY.MM.dd}"  
}  
}  
stdout { codec =\> rubydebug }  
}

But no results

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 7, 2017, 5:27am UTC](https://discuss.elastic.co/t/logging-form-folder-with-subfolders/95907/2 "2017-08-07T05:27:23Z")

</div>

Are the `site` and `kind` fields being populated, i.e. are the grok filters working? Forget about the elasticsearch output for now, use the `stdout { codec => rubydebug }` output while debugging.

---

<div class="post-metadata">

**Author:** ![Alex\_Kovalyov](https://avatars.discourse-cdn.com/v4/letter/a/b5e925/32.png) [@Alex\_Kovalyov](https://discuss.elastic.co/u/Alex_Kovalyov)\
**Post date:** [August 8, 2017, 1:27pm UTC](https://discuss.elastic.co/t/logging-form-folder-with-subfolders/95907/3 "2017-08-08T13:27:29Z")

</div>

Magnus Bäck, thanks. I found problem and solution

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 5, 2017, 1:27pm UTC](https://discuss.elastic.co/t/logging-form-folder-with-subfolders/95907/4 "2017-09-05T13:27:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.