Split filepath to a new field

Another option is split and take whatever is on the 4th position.

    mutate { copy => { "[log][file][path]" => "[@metadata][path]"}}
    mutate {  split  => { "[@metadata][path]" => "/" }      }
    mutate { add_field => { "devicename" => "%{[@metadata][path][4]}"}}
1 Like