# Not able to get Source filename in the logstash output
**URL:** https://discuss.elastic.co/t/not-able-to-get-source-filename-in-the-logstash-output/322130
**Category:** Logstash
**Created:** [December 29, 2022, 4:45am UTC](https://discuss.elastic.co/t/not-able-to-get-source-filename-in-the-logstash-output/322130 "2022-12-29T04:45:46Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Ramesh\_Perumal](https://discuss.elastic.co/u/Ramesh_Perumal)
#### Post date: [December 29, 2022, 4:45am UTC](https://discuss.elastic.co/t/not-able-to-get-source-filename-in-the-logstash-output/322130/1 "2022-12-29T04:45:46Z")
Hi,
We are using filebeat 7.10.2 and logstash 8.10.4. Filebeat transfer the files from Machine A (Filebeat) to Machine B (Logstash) and Logstash writes the same in machine B's path (/va/pm/sfile/%{hostname}/%{[log][file][name]})
Below are the logstash.conf
filter {
dissect {
mapping =\> {
"[log][file][path]" =\> "/ar/log/sa/pm/%{[log][file][name]}"
}
mapping =\> {
"[log][file][path]" =\> "/ar/log/ng/pm/reports/%{[log][file][name]}"
}
}
}
output {
file {
path =\> "/car/reports/files/%{hostname}/%{[log][file][name]}"
"dir\_mode" =\> 0640
"file\_mode" =\> 0640
}
}
Logstash writes the file with the name as %{[log][file][name]} and it is not replacing the actual source file name.
Please share your expertise to resolve this.
Regards,
Ramesh P
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 29, 2022, 5:34pm UTC](https://discuss.elastic.co/t/not-able-to-get-source-filename-in-the-logstash-output/322130/2 "2022-12-29T17:34:45Z")
> [@Ramesh\_Perumal](#):
>
> dissect {
> mapping =\> { "[log][file][path]" =\> "/ar/log/sa/pm/%{[log][file][name]}" }
> mapping =\> { "[log][file][path]" =\> "/ar/log/ng/pm/reports/%{[log][file][name]}" }
> }
The mapping option of a dissect filter is a [hash](https://github.com/logstash-plugins/logstash-filter-dissect/blob/2eead0ed975b7af3e03654c36f923df1ece2305f/lib/logstash/filters/dissect.rb#L147), so if you specify the same entry twice then one will overwrite the other. If the /ar/log/sa/ entry is overwritten by the /ar/log/ng entry then files from /ar/log/sa/ will not be parsed. They will get a \_dissectfailure tag and the [log][file][name] field will not exist, so it will not get substituted.
The [documentation says](https://www.elastic.co/guide/en/logstash/current/plugins-filters-dissect.html#_conditional_processing) that you may need a conditional to determine whether to apply a particular dissect to a field.
---
### Author:  [@Ramesh\_Perumal](https://discuss.elastic.co/u/Ramesh_Perumal)
#### Post date: [December 30, 2022, 10:57am UTC](https://discuss.elastic.co/t/not-able-to-get-source-filename-in-the-logstash-output/322130/3 "2022-12-30T10:57:43Z")
Thanks, Badger. It is working now
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 27, 2023, 10:57am UTC](https://discuss.elastic.co/t/not-able-to-get-source-filename-in-the-logstash-output/322130/4 "2023-01-27T10:57:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.