# Matching log.file.path with Grok

**URL:** https://discuss.elastic.co/t/matching-log-file-path-with-grok/235649
**Category:** Logstash
**Created:** [June 3, 2020, 11:05pm UTC](https://discuss.elastic.co/t/matching-log-file-path-with-grok/235649 "2020-06-03T23:05:52Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Maria\_Daniel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maria_daniel/32/69697_2.png) [@Maria\_Daniel](https://discuss.elastic.co/u/Maria_Daniel)
#### Post date: [June 3, 2020, 11:05pm UTC](https://discuss.elastic.co/t/matching-log-file-path-with-grok/235649/1 "2020-06-03T23:05:52Z")

</div>

Hello!

So, I'm trying to use the log filename to generate a new field that is searchable on Kibana.

Currently I have this on my logstash pipeline:

```auto
    if "delivery_conn_results" in [tags] {
	grok {
		match => { 
                "log.file.path" => "/var/log/conn/(?<d1>.)/(?<d2>.)/(?<message_token>.*(?=\.))"
            }
		add_tag => ["my_parsed_tag"]
	}
	
	}

```

And this is the kind of file path I have:

```auto
    /var/log/conn/D/D/DD9A0BDC-D620-4705-9E63-A762AA7D8FA6.results

```

I've used grokconstructor to test the pattern and it _should_ work. However, i'm getting a \_grokparsefailure.

What should I do?

Thanks in advance!

---

<div class="post-metadata">

### Author: ![Maria\_Daniel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maria_daniel/32/69697_2.png) [@Maria\_Daniel](https://discuss.elastic.co/u/Maria_Daniel)
#### Post date: [June 3, 2020, 11:28pm UTC](https://discuss.elastic.co/t/matching-log-file-path-with-grok/235649/2 "2020-06-03T23:28:59Z")

</div>

Hi again!

I changed it to:

```auto

match => { 
                "[log][file][path]" => "/var/log/conn/(?<d1>.)/(?<d2>.)/(?<message_token>.*(?=\.)).results"
            }

```

It works now! So I just had to use **[log][file][path]** instead of **log.file.path**.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 1, 2020, 11:29pm UTC](https://discuss.elastic.co/t/matching-log-file-path-with-grok/235649/3 "2020-07-01T23:29:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.