Mutate --> gsub - remove path and file extension from source

[dmccuk (Dennis)]

Hi,

Is anyone able to point me in the right direction for this mutate --> gsub I'm attempting.

I have a source logfile with a path and file extension. What I'm looking to do is remove the path and the file extensions. Below is an example:

source:
/path/to/the/log/file/logfile.0.log

so far I've been able to make it work in two parts but I would like to clean up my string and do it properly.

This is what I have so far:

I mutate the source and create a new field like this:

    add_field => { "shortname" => "%{source}" }

Then i run this filter to strip out the bits I don't want/need:

filter {
  mutate {
    gsub => [ "shortname", "^(.){22}", "" ]
    gsub => [ "shortname", ".{6}$", "" ]
  }
}

So by ignoring the first 22 characters and then ignoring the last 6 characters i'm left with:

logfile

It's not really the best way to do it. Could anyone give me some pointers so I'm able to do this is one gsub string?

Thanks for your help.

Dennis

[dmccuk (Dennis)]

I found this link that helped me solve how to remove the file extension (everything after the first "."):

https://groups.google.com/forum/#!searchin/logstash-users/gsub|sort:date/logstash-users/wf4oSEUOlJI/85jttkZjrAsJ