# Parse directory name regex

**URL:** https://discuss.elastic.co/t/parse-directory-name-regex/36778
**Category:** Logstash
**Created:** [December 9, 2015, 5:48pm UTC](https://discuss.elastic.co/t/parse-directory-name-regex/36778 "2015-12-09T17:48:31Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Sonne](https://avatars.discourse-cdn.com/v4/letter/s/d26b3c/32.png) [@Sonne](https://discuss.elastic.co/u/Sonne)
#### Post date: [December 9, 2015, 5:48pm UTC](https://discuss.elastic.co/t/parse-directory-name-regex/36778/1 "2015-12-09T17:48:31Z")

</div>

Hello. I have the logline  
2015.10.05 18:32:25.913:Process cannot access the file 'file.txt' because it is being used by another process ![](https://us1.discourse-cdn.com/elastic/original/2X/2/24749abf8318af9c3fc98fff8232a52cd0ff2298.png)

I have written the grok:

> (?m)%{YEAR:year}.%{MONTHNUM:month}.%{MONTHDAY:day}%{SPACE}%{TIME:time}:%{GREEDYDATA:text}

I need to parse name of directory in the brackets : ![](https://us1.discourse-cdn.com/elastic/original/2X/a/a7535e2f67ffb47eb19d5ddf207f6ee5b5eb91b6.png). I need only parse a directory name after "Log" folder. Directory name could be named as 3-digit name. Folder's name should be written to "fldrname" field. After parsing  
 ![](https://us1.discourse-cdn.com/elastic/original/2X/2/225469ba772ab6a6650bd7ca3fb052d957e06ad0.png)

need to be deleted from @message. I will be appreciate for any help.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 9, 2015, 6:05pm UTC](https://discuss.elastic.co/t/parse-directory-name-regex/36778/2 "2015-12-09T18:05:18Z")

</div>

So you want C:\AR\Log\178 in the `fldrname` field? Match everything in the string up until the last backslash. The last backslash is the backslash that isn't followed by another backslash. Untested suggestion:

```
%{GREEDYDATA:fldrname}\\[^\\]+$
```

---

<div class="post-metadata">

### Author: ![Sonne](https://avatars.discourse-cdn.com/v4/letter/s/d26b3c/32.png) [@Sonne](https://discuss.elastic.co/u/Sonne)
#### Post date: [December 10, 2015, 1:13am UTC](https://discuss.elastic.co/t/parse-directory-name-regex/36778/3 "2015-12-10T01:13:56Z")

</div>

I want only `178` in `fldrname`

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 10, 2015, 6:42am UTC](https://discuss.elastic.co/t/parse-directory-name-regex/36778/4 "2015-12-10T06:42:27Z")

</div>

Slight variation then:

```
%{GREEDYDATA}\\(?<fldrname>[^\\]+)\\[^\\]+$
```

---

<div class="post-metadata">

### Author: ![Sonne](https://avatars.discourse-cdn.com/v4/letter/s/d26b3c/32.png) [@Sonne](https://discuss.elastic.co/u/Sonne)
#### Post date: [December 10, 2015, 8:39am UTC](https://discuss.elastic.co/t/parse-directory-name-regex/36778/5 "2015-12-10T08:39:00Z")

</div>

Thank you. It's working.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:19am UTC](https://discuss.elastic.co/t/parse-directory-name-regex/36778/6 "2017-07-06T05:19:10Z")

</div>