# Need to get filenames at a particular directory without reading the data inside files
**URL:** https://discuss.elastic.co/t/need-to-get-filenames-at-a-particular-directory-without-reading-the-data-inside-files/176188
**Category:** Logstash
**Created:** [April 10, 2019, 9:40am UTC](https://discuss.elastic.co/t/need-to-get-filenames-at-a-particular-directory-without-reading-the-data-inside-files/176188 "2019-04-10T09:40:18Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@shruti51](https://discuss.elastic.co/u/shruti51)
#### Post date: [April 10, 2019, 9:40am UTC](https://discuss.elastic.co/t/need-to-get-filenames-at-a-particular-directory-without-reading-the-data-inside-files/176188/1 "2019-04-10T09:40:19Z")
Hi,
I am trying to read the file names without reading the content inside file.
I am not able to get the desired result using filebeat.
The logstash is:
```
input {
> beats {
> port => 5044
> }
> }
filter {
if [fields][log_type] == "check-filename" {
grok {
match => ["source","D:/ELK Demo Logs/STO/%{GREEDYDATA:filename}"]
}
mutate {
remove_field => ["host"]
add_field => ["Promotion_Source", "XMLs"]
}
}
}
output {
elasticsearch {
hosts => "localhost:9200"
manage_template => false
index => "abc-ind-%{+YYYY.MM.dd}"
}
stdout { codec => rubydebug }
}
```
My Filebeat is:
- type: log
enabled: true
paths:
- D:\ELK Demo Logs\STO\*.txt
fields: {log\_type: check-filename}
In my output,no filename column is created.Please help if you see any discrepancy in code or any other change needed.
Thanks in advance.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 10, 2019, 11:22am UTC](https://discuss.elastic.co/t/need-to-get-filenames-at-a-particular-directory-without-reading-the-data-inside-files/176188/2 "2019-04-10T11:22:23Z")
Do your events have a \_grokparsefailure tag? I would expect source to have backslashes, not forward slashes. Try changing the grok to
```
match => ["source","^D:\\ELK Demo Logs\\STO\\%{GREEDYDATA:filename}"]
```
---
### Author:  [@shruti51](https://discuss.elastic.co/u/shruti51)
#### Post date: [April 15, 2019, 10:51am UTC](https://discuss.elastic.co/t/need-to-get-filenames-at-a-particular-directory-without-reading-the-data-inside-files/176188/3 "2019-04-15T10:51:20Z")
Thankyou very much Badger.
The code is reading filename now.
Now, the logstash is reading filename as many times as there are records in file.
I only want to get the filename once,no matter how many records are inside the file.
Example: There are 3 records in a file abc.txt
I am getting Filename 3 times.
I dont need to parse records of filename but to get the filename only once.
Please suggest the approach to it.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 15, 2019, 11:24am UTC](https://discuss.elastic.co/t/need-to-get-filenames-at-a-particular-directory-without-reading-the-data-inside-files/176188/4 "2019-04-15T11:24:15Z")
If you want to avoid duplicate events being indexed into elasticsearch then [this](https://www.elastic.co/blog/logstash-lessons-handling-duplicates) blog post provides suggestions.
You could also do it with an aggregate filter. Use the filename as the task\_id and then
```
code => 'map["occurs"] ||= 0; map["occurs"] += 1; if map["occurs"] > 1 then event.cancel end'
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 13, 2019, 11:24am UTC](https://discuss.elastic.co/t/need-to-get-filenames-at-a-particular-directory-without-reading-the-data-inside-files/176188/5 "2019-05-13T11:24:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.