# Stdout cause syslog file to be to big

**URL:** https://discuss.elastic.co/t/stdout-cause-syslog-file-to-be-to-big/360107
**Category:** Logstash
**Created:** [May 23, 2024, 10:48pm UTC](https://discuss.elastic.co/t/stdout-cause-syslog-file-to-be-to-big/360107 "2024-05-23T22:48:39Z")
**Posts on this page:** 1
**Showing post:** 5

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 24, 2024, 5:10pm UTC](https://discuss.elastic.co/t/stdout-cause-syslog-file-to-be-to-big/360107/5 "2024-05-24T17:10:05Z")

</div>

> [@Honestabe](#):
>
> Is there a way to name based on the pipeline and host it is coming from?

You can reference any field on the event in the path option of the file output, although there are [a couple of restrictions](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-file.html#plugins-outputs-file-path).

You could use a ruby filter to add the [pipeline\_id](https://discuss.elastic.co/t/logstash-access-name-of-current-pipeline-within-cfg/195786/2) and [hostname](https://discuss.elastic.co/t/adding-logstash-ip-address-field-when-processing-filter/270055/3) to the event. I would add them inside the [@metadata] field, which you can reference in the output using %{}, but they will not be sent to the destination with the rest of the fields on the event.

Something like

```
ruby {
    init => 'require "socket"'
    code => '
        # Or save in @class variable in init to avoid repeated call
        event.set("[@metadata][hostname]", Socket.gethostname)

        event.set("[@metadata][pipeline_id]", execution_context.pipeline.pipeline_id)"
    '
 }

```

...

```
file {
    path => "/TheFixedBit/%{[@metadata][hostname]/%{@metadata][pipeline_id]}-%{+YYYY-MM-dd}.log"
    ...

```

---

_[View the full topic](https://discuss.elastic.co/t/stdout-cause-syslog-file-to-be-to-big/360107)._