# Parse source field

**URL:** https://discuss.elastic.co/t/parse-source-field/154987
**Category:** Logstash
**Created:** [November 1, 2018, 10:01am UTC](https://discuss.elastic.co/t/parse-source-field/154987 "2018-11-01T10:01:46Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![luggo](https://avatars.discourse-cdn.com/v4/letter/l/5e9695/32.png) [@luggo](https://discuss.elastic.co/u/luggo)
#### Post date: [November 1, 2018, 10:01am UTC](https://discuss.elastic.co/t/parse-source-field/154987/1 "2018-11-01T10:01:47Z")

</div>

Hey community,

my source field (provided by filebeat) contains information about the host, the application and the version. Those are information that need to be in my log entries in Elasticsearch.

Example source:

```
C:\Projects\Elastic\Logs\extern\xmf20\ecext3\eb_xmf20_lvasp-ecext3_2018-06-21##20180618171421_19.3.0.4297.log

C:\Projects\Elastic\Logs\extern\{APP}\{SERVER}\eb_{APP}_{SERVER}_2018-06-21##20180618171421_{VERSION}.log

```

How can I use/parse the source field (provided by filebeat), to create fields and also determine dynamically the target elasticsearch index as the output?

Best regards

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [November 1, 2018, 10:26am UTC](https://discuss.elastic.co/t/parse-source-field/154987/2 "2018-11-01T10:26:34Z")

</div>

For that you will typically use either Logstash or an ingest pipeline.

---

<div class="post-metadata">

### Author: ![luggo](https://avatars.discourse-cdn.com/v4/letter/l/5e9695/32.png) [@luggo](https://discuss.elastic.co/u/luggo)
#### Post date: [November 1, 2018, 10:32am UTC](https://discuss.elastic.co/t/parse-source-field/154987/3 "2018-11-01T10:32:27Z")

</div>

> [@Christian\_Dahlqvist](#):
>
> For that you will typically use either Logstash or an ingest pipeline.

Hey Christian, yes I want to use Logstash for this problem. That's why I have posted my question in the Logstash category.

But my question is, how to use Logstash to solve my problem.

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [November 1, 2018, 10:40am UTC](https://discuss.elastic.co/t/parse-source-field/154987/4 "2018-11-01T10:40:29Z")

</div>

If you have not used Logstash before I would recommend going through [this introduction](https://www.elastic.co/blog/a-practical-introduction-to-logstash) and the [getting started guide](https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html) in the documentation. Otherwise please show us what you have got so far.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 29, 2018, 10:40am UTC](https://discuss.elastic.co/t/parse-source-field/154987/5 "2018-11-29T10:40:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.