Hi! I use Filebeat on a central Syslog server which collects logs from all network devices. Filebeat is configured to collect the logs (which are arrenged by days in the month) from this server and sends them to Logstash. The log.file.path fileld's value is the following: /var/log/remote/device na…

Another option is split and take whatever is on the 4th position. mutate { copy => { "[log][file][path]" => "[@metadata][path]"}} mutate { split => { "[@metadata][path]" => "/" } } mutate { add_field => { "devicename" => "%{[@metadata][path][4]}"}}

Split filepath to a new field

Elastic Stack Logstash

Rios (Rios) November 23, 2022, 2:21pm 2

Is this you looking for?

    mutate { add_field => { "devicename" => "%{[log][file][path]}" } }
    mutate{ gsub => ["devicename", '/var/log/remote/', "" ] }
    mutate{ gsub => ["devicename", '[/]', "" ] }

Also is possible by grok

Is it possible to create multiple index with multiple folder name

Topic		Replies	Views
Extract folder name as field in logstash Beats filebeat	8	790	June 16, 2022
Can we extract folder and file out of log.file.path field? Kibana	5	2785	March 3, 2020
Extract file name and add as a field Logstash	3	2426	September 18, 2021
Filebeat field depending on Path Beats filebeat	4	478	February 19, 2018
Filebeat and parsing Beats	3	648	July 12, 2017

Split filepath to a new field

Related Topics