# Path params problem

**URL:** <https://discuss.elastic.co/t/path-params-problem/69729>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [December 22, 2016, 3:07am UTC](https://discuss.elastic.co/t/path-params-problem/69729 "2016-12-22T03:07:41Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![laywin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/laywin/32/14059_2.png) [@laywin](https://discuss.elastic.co/u/laywin)\
**Post date:** [December 22, 2016, 3:07am UTC](https://discuss.elastic.co/t/path-params-problem/69729/1 "2016-12-22T03:07:41Z")

</div>

hello! we recently have a demand which is that we want to get matched path params.

example:

we config filebeat path like: /var/log/_/_.log, matched path is : /var/log/aa/bb.log

we want to get 'aa' and 'bb' params to be our index name.

logstash grok filter can achieve this,but instead,we want to use filebeat.

search for a help or suggest,thanks in advance!

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [December 22, 2016, 4:25am UTC](https://discuss.elastic.co/t/path-params-problem/69729/2 "2016-12-22T04:25:41Z")

</div>

You would have to parse the `source` field in either Logstash or Ingest Node and then set the index based on that. You cannot parse the filename directly in Filebeat.

Depending on the number of permutations you have you could take a simpler approach. The example below would set the index based on a static field defined in the prospector config.

```auto
filebeat.prospectors:
- paths: ['/var/log/aa/*.log']
  fields: {index: aa}
- paths: ['/var/log/bb/*.log']
  fields: {index: bb}

output.elasticsearch:
  hosts: ['localhost:9200']
  index: '%{[fields.index]}-%{+yyyy.MM.dd}'

```

---

<div class="post-metadata">

**Author:** ![laywin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/laywin/32/14059_2.png) [@laywin](https://discuss.elastic.co/u/laywin)\
**Post date:** [December 22, 2016, 7:42am UTC](https://discuss.elastic.co/t/path-params-problem/69729/3 "2016-12-22T07:42:45Z")

</div>

static field is not so flexible,because there are many directory in /var/log/,currently,we use logstash to achieve this,logstash parse source can also slove the problem. could filebeat provide a way to achieve this in the future,thus we will use logstash less often!

thanks your reply!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 19, 2017, 7:43am UTC](https://discuss.elastic.co/t/path-params-problem/69729/4 "2017-01-19T07:43:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.