Mutate --> gsub - remove path and file extension from source


Is anyone able to point me in the right direction for this mutate --> gsub I'm attempting.

I have a source logfile with a path and file extension. What I'm looking to do is remove the path and the file extensions. Below is an example:


so far I've been able to make it work in two parts but I would like to clean up my string and do it properly.

This is what I have so far:

I mutate the source and create a new field like this:

    add_field => { "shortname" => "%{source}" }

Then i run this filter to strip out the bits I don't want/need:

filter {
  mutate {
    gsub => [ "shortname", "^(.){22}", "" ]
    gsub => [ "shortname", ".{6}$", "" ]

So by ignoring the first 22 characters and then ignoring the last 6 characters i'm left with:


It's not really the best way to do it. Could anyone give me some pointers so I'm able to do this is one gsub string?

Thanks for your help.


I found this link that helped me solve how to remove the file extension (everything after the first "."):!searchin/logstash-users/gsub|sort:date/logstash-users/wf4oSEUOlJI/85jttkZjrAsJ

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.