# Mutate --\> gsub - remove path and file extension from source

**URL:** <https://discuss.elastic.co/t/mutate-gsub-remove-path-and-file-extension-from-source/131119>\
**Category:** Logstash\
**Created:** [May 9, 2018, 7:42am UTC](https://discuss.elastic.co/t/mutate-gsub-remove-path-and-file-extension-from-source/131119 "2018-05-09T07:42:37Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dmccuk](https://avatars.discourse-cdn.com/v4/letter/d/3d9bf3/32.png) [@dmccuk](https://discuss.elastic.co/u/dmccuk)\
**Post date:** [May 9, 2018, 7:42am UTC](https://discuss.elastic.co/t/mutate-gsub-remove-path-and-file-extension-from-source/131119/1 "2018-05-09T07:42:37Z")

</div>

Hi,

Is anyone able to point me in the right direction for this mutate --\> gsub I'm attempting.

I have a source logfile with a path and file extension. What I'm looking to do is remove the path and the file extensions. Below is an example:

source:  
/path/to/the/log/file/logfile.0.log

so far I've been able to make it work in two parts but I would like to clean up my string and do it properly.

This is what I have so far:

I mutate the source and create a new field like this:

```
    add_field => { "shortname" => "%{source}" }

```

Then i run this filter to strip out the bits I don't want/need:

```
filter {
  mutate {
    gsub => ["shortname", "^(.){22}", ""]
    gsub => ["shortname", ".{6}$", ""]
  }
}

```

So by ignoring the first 22 characters and then ignoring the last 6 characters i'm left with:

```
logfile

```

It's not really the best way to do it. Could anyone give me some pointers so I'm able to do this is one gsub string?

Thanks for your help.

Dennis

---

<div class="post-metadata">

**Author:** ![dmccuk](https://avatars.discourse-cdn.com/v4/letter/d/3d9bf3/32.png) [@dmccuk](https://discuss.elastic.co/u/dmccuk)\
**Post date:** [May 9, 2018, 8:18am UTC](https://discuss.elastic.co/t/mutate-gsub-remove-path-and-file-extension-from-source/131119/2 "2018-05-09T08:18:58Z")

</div>

I found this link that helped me solve how to remove the file extension (everything after the first "."):

[https://groups.google.com/forum/#!searchin/logstash-users/gsub|sort:date/logstash-users/wf4oSEUOlJI/85jttkZjrAsJ](https://groups.google.com/forum/#!searchin/logstash-users/gsub%7Csort:date/logstash-users/wf4oSEUOlJI/85jttkZjrAsJ)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 6, 2018, 8:19am UTC](https://discuss.elastic.co/t/mutate-gsub-remove-path-and-file-extension-from-source/131119/3 "2018-06-06T08:19:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.