Logstash: regex to get part of file name

[nameisnotimportant]

Hi,

I am trying to get the date in the file name using following regex, but it still return a-zA-Z character:

Path:
/home/appadmin/Documents/ML/data/pocket_pmo/activityLogs20201211.csv

grok { match => { "path" => "(?<[@metadata][indexName]>[^/][\d]*)....$" } }
mutate {
add_field => {"indexname" => "%{[@metadata][indexName]}" }
}

result:

"indexname" => "s20201211"

May i know why the character 's' still there? How do i get only the date ?

Regards.

[Badger]

@nameisnotimportant

May i know why the character 's' still there?

"(?<[@metadata][indexName]>[^/][\d]*) captures a single character that is not slash (i.e. the 's'), followed by zero or more digits. You already have the pattern anchored to the end of the string, and I see no reason to include the [^/].

[nameisnotimportant]

If i remove [^/] to become the following:

grok { match => { "path" => "(?<[@metadata][indexName]>[\d]*)....$" } }

i got the following results:

"indexname" => "%{[@metadata][indexName]}"