# Match beats "source"

**URL:** <https://discuss.elastic.co/t/match-beats-source/48821>\
**Category:** Logstash\
**Created:** [April 29, 2016, 3:41pm UTC](https://discuss.elastic.co/t/match-beats-source/48821 "2016-04-29T15:41:09Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Zfs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zfs/32/13370_2.png) [@Zfs](https://discuss.elastic.co/u/Zfs)\
**Post date:** [April 29, 2016, 3:41pm UTC](https://discuss.elastic.co/t/match-beats-source/48821/1 "2016-04-29T15:41:09Z")

</div>

match =\> { "source" =\> "C:\Progra~1\worker\engine\work\%{INT:logID}" }

I have grok matching "message" but I'm trying to match the source from where beats reads in the file. Adding a match for source under grok doesn't seem to detect source at all.

How can I go about extracting a field from the source?

Thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 30, 2016, 3:29pm UTC](https://discuss.elastic.co/t/match-beats-source/48821/2 "2016-04-30T15:29:54Z")

</div>

Do you have this line in a grok filter of its own? The backslashes probably need to be escaped. Try this:

```
C:\\Progra~1\\worker\\engine\\work\\%{INT:logID}
```

---

<div class="post-metadata">

**Author:** ![Zfs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zfs/32/13370_2.png) [@Zfs](https://discuss.elastic.co/u/Zfs)\
**Post date:** [April 30, 2016, 4:43pm UTC](https://discuss.elastic.co/t/match-beats-source/48821/3 "2016-04-30T16:43:10Z")

</div>

Hi Magnus,

I had the double basckslashes but they were probably stripped when I posted. I separated the "source" grok filter from the "message" grok filter and that did the trick.

Thanks for your help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:59am UTC](https://discuss.elastic.co/t/match-beats-source/48821/4 "2017-07-06T04:59:51Z")

</div>