# Source field parse not working **URL:** \ **Category:** Logstash\ **Created:** [April 20, 2018, 12:24am UTC](https://discuss.elastic.co/t/source-field-parse-not-working/128780 "2018-04-20T00:24:00Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![sachinvy](https://avatars.discourse-cdn.com/v4/letter/s/6a8cbe/32.png) [@sachinvy](https://discuss.elastic.co/u/sachinvy)\ **Post date:** [April 20, 2018, 12:24am UTC](https://discuss.elastic.co/t/source-field-parse-not-working/128780/1 "2018-04-20T00:24:00Z")
Input: `"source": "E:\\Program Files\\GlobalSCAPE\\EFT Enterprise\\Config\\Logs\\u_ex180419.log"` Filter: `if [source] =~ "^.*u_ex.*$"` This is not working. Can someone please help me here? ---
**Author:** ![sachinvy](https://avatars.discourse-cdn.com/v4/letter/s/6a8cbe/32.png) [@sachinvy](https://discuss.elastic.co/u/sachinvy)\ **Post date:** [April 20, 2018, 7:13am UTC](https://discuss.elastic.co/t/source-field-parse-not-working/128780/2 "2018-04-20T07:13:20Z")
I want to pick up files like u\_ex\*.log and eft\*.log (with case insensitive). Can someone please help? ---
**Author:** ![sachinvy](https://avatars.discourse-cdn.com/v4/letter/s/6a8cbe/32.png) [@sachinvy](https://discuss.elastic.co/u/sachinvy)\ **Post date:** [April 20, 2018, 7:23am UTC](https://discuss.elastic.co/t/source-field-parse-not-working/128780/3 "2018-04-20T07:23:40Z")
Here is eft source `E:\Program Files\GlobalSCAPE\EFT Enterprise\Config\EFT.log` ---
**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\ **Post date:** [April 20, 2018, 7:51am UTC](https://discuss.elastic.co/t/source-field-parse-not-working/128780/4 "2018-04-20T07:51:17Z")
Could you post your full configuration? The regex looks right, so maybe there is another error. ---
**Author:** ![sachinvy](https://avatars.discourse-cdn.com/v4/letter/s/6a8cbe/32.png) [@sachinvy](https://discuss.elastic.co/u/sachinvy)\ **Post date:** [April 20, 2018, 7:56am UTC](https://discuss.elastic.co/t/source-field-parse-not-working/128780/5 "2018-04-20T07:56:19Z")
Here it is: Input: ``` input { beats { port => 5045 } } ``` Filter: ``` filter { mutate{ lowercase => ["source"] } if [source] =~ "^.*eft.*$" { mutate { replace => { type => "eftlog" } add_field => {"[@metadata][indexname]" => "eftlog" } } if [message] =~ /^\s*$/ { drop { } } grok{ match => {"message" => "%{DATESTAMP:date}\,%{NUMBER:msgnum} \[%{NOTSPACE:session}\] %{LOGLEVEL:src} %{GREEDYDATA:msgdata}"} #overwrite => ["message"] } date { match => ["date", "MM-dd-yy HH:mm:ss"] locale => "en-US" timezone => "America/New_York" target => "@timestamp" } mutate{ convert => {"msgnum" => "integer"} convert => {"session" => "integer"} } } else if [source] =~ "^.*u_ex.*$" { mutate { replace => { type => "ftplog" } add_field => {"[@metadata][indexname]" => "ftplog" } } grok{ match => {"message" => "%{TIMESTAMP_ISO8601:date} %{IP:c-ip} %{NOTSPACE:c-port} %{NOTSPACE:cs-username} \[%{NUMBER:session}\]%{NOTSPACE:cs-method} %{NOTSPACE:cs-uri-stem} %{NOTSPACE:cs-uri-query} %{NUMBER:sc-status} %{NOTSPACE:sc-bytes} %{NOTSPACE:cs-bytes} %{NOTSPACE:s-name} %{NOTSPACE:sc-port}"} } ruby { code => " hash = event.to_hash hash.each do |k,v| if v== '-' event.set(k,0) end end " } date { match => ["date", "yyyy-MM-dd HH:mm:ss"] locale => "en-US" timezone => "America/New_York" target => "@timestamp" } mutate{ convert => {"session" => "integer"} convert => {"c-port" => "integer"} convert => {"sc-bytes" => "integer"} convert => {"cs-bytes" => "integer"} convert => {"sc-port" => "integer"} convert => {"sc-status" => "integer"} } } else { mutate { replace => { type => "random_logs" } } } } ``` Output: ``` output { stdout {codec => rubydebug} } ``` ---
**Author:** ![sachinvy](https://avatars.discourse-cdn.com/v4/letter/s/6a8cbe/32.png) [@sachinvy](https://discuss.elastic.co/u/sachinvy)\ **Post date:** [April 20, 2018, 8:00am UTC](https://discuss.elastic.co/t/source-field-parse-not-working/128780/6 "2018-04-20T08:00:03Z")
I want to include "\*.log" so that my eft regex will not get confuse with u\_ex's eft source. All data from u\_ex are also going under eft index. ---
**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\ **Post date:** [April 20, 2018, 12:39pm UTC](https://discuss.elastic.co/t/source-field-parse-not-working/128780/7 "2018-04-20T12:39:34Z")
I still cannot see what might be wrong. Maybe you could post the full input and output? ---
**Author:** ![sachinvy](https://avatars.discourse-cdn.com/v4/letter/s/6a8cbe/32.png) [@sachinvy](https://discuss.elastic.co/u/sachinvy)\ **Post date:** [April 23, 2018, 10:52pm UTC](https://discuss.elastic.co/t/source-field-parse-not-working/128780/8 "2018-04-23T22:52:05Z")
I am looking for simple regex expression where if input files are like following and I want to have my if else statement based on filename. But I am not able to get regex working and all my output going to random\_logs instead of eft or ftp logs. Filenames like these: /user/globalscape/eft/config/logs/eft\_20180301.log /user/globalscape/eft/config/logs/eft\_20180302.log /user/globalscape/eft/config/logs/u\_extest\_20180301.log /user/globalscape/eft/config/logs/u\_extest\_20180302.log So basically I want eft\*.log files to go under eft index and u\_extest\*.log go under ftp index. Thanks ---
**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\ **Post date:** [April 24, 2018, 7:08am UTC](https://discuss.elastic.co/t/source-field-parse-not-working/128780/9 "2018-04-24T07:08:42Z")
I do know what you want, so please don't just ignore requests for further information. I wanted to see the output because I had hoped that this helps us find the error. I can see one problem: Your 'u\_ex' logs are in a folder with 'eft' in its name. So they would be considered 'eft' logs. You could change that by turning around the two conditions or you have to make the regular expressions more specific. But I don't see a reason for them to go to 'random\_logs'. ---
**Author:** ![sachinvy](https://avatars.discourse-cdn.com/v4/letter/s/6a8cbe/32.png) [@sachinvy](https://discuss.elastic.co/u/sachinvy)\ **Post date:** [April 24, 2018, 8:54pm UTC](https://discuss.elastic.co/t/source-field-parse-not-working/128780/10 "2018-04-24T20:54:02Z")
Yes you are spot on Jenni. Since we can't change file location, I had to make changes to regex to fix the issue. Thanks again for your help Jenni. Thanks ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 22, 2018, 8:54pm UTC](https://discuss.elastic.co/t/source-field-parse-not-working/128780/11 "2018-05-22T20:54:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.