Tag input name file

Elastic Stack Logstash
1

It 's possible to tag multiple input file name ?
I have many txt file and I want to tag all file maybe with name file if it's possible.

input {
   file {
    path => "/var/log/testing/*.txt"
    start_position => "beginning"
    sincedb_path => "/dev/null"
    ignore_older => "0"
    tags => ["events"]
  }
}
2

Logstash already adds a field with the path to the input file from which the event was read.

3

Thanks Magnusbaeck. I solved with this logstash conf.

input {
   file {
    path => "/var/log/testing/*.txt"
    start_position => "beginning"
    sincedb_path => "/dev/null"
    ignore_older => "0"
    tags => ["events"]
  }
}
    filter {
     
      if "events" in [tags]{
       grok {
          match => { "path" => "%{UNIXPATH:path_tag}/%{GREEDYDATA:namefile_tag}\.txt\.*" }
        }
       mutate {
        add_tag => [ "%{namefile_tag}" ]
       }  
     }

 output {
      stdout {}
      
      file {
            path => "/var/log/logstash/tagged_stdout.log"
      }
 }

Now ,I have some _groktimeout tag on tags. Maybe is wrong the grok parser.

4

Don't use UNIXPATH. There was a recent thread about this not 24 hours ago.

5

Thanks! I solved.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.