Parse directory name regex

Elastic Stack Logstash
1

Hello. I have the logline
2015.10.05 18:32:25.913:Process cannot access the file 'file.txt' because it is being used by another process

I have written the grok:

(?m)%{YEAR:year}.%{MONTHNUM:month}.%{MONTHDAY:day}%{SPACE}%{TIME:time}:%{GREEDYDATA:text}

I need to parse name of directory in the brackets : . I need only parse a directory name after "Log" folder. Directory name could be named as 3-digit name. Folder's name should be written to "fldrname" field. After parsing

need to be deleted from @message. I will be appreciate for any help.

2

So you want C:\AR\Log\178 in the fldrname field? Match everything in the string up until the last backslash. The last backslash is the backslash that isn't followed by another backslash. Untested suggestion:

%{GREEDYDATA:fldrname}\\[^\\]+$
3

I want only 178 in fldrname

4

Slight variation then:

%{GREEDYDATA}\\(?<fldrname>[^\\]+)\\[^\\]+$
1 Like
5

Thank you. It's working.