# Using dissect dynamicly on filepath

**URL:** <https://discuss.elastic.co/t/using-dissect-dynamicly-on-filepath/249663>\
**Category:** Logstash\
**Tags:** docker\
**Created:** [September 23, 2020, 1:22pm UTC](https://discuss.elastic.co/t/using-dissect-dynamicly-on-filepath/249663 "2020-09-23T13:22:04Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![ThePreMan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thepreman/32/82548_2.png) [@ThePreMan](https://discuss.elastic.co/u/ThePreMan)\
**Post date:** [September 23, 2020, 1:22pm UTC](https://discuss.elastic.co/t/using-dissect-dynamicly-on-filepath/249663/1 "2020-09-23T13:22:05Z")

</div>

Hi. Im trying to setup a workflow where people can upload there log files onto a webserver and while doing so add tags to the log file for further differenciation. I was thinking of putting tags into the file name like `filename-tag1-tag2-tag3-tag4-tagN.log`. Then logstash or filebeat should be able to run a dissect operation which then would lead to the tags being shown in kibana under `tags`.  
First: Do you think that is possible ? And second: can you build it to be dynamic no matter how many tags you put in ?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 23, 2020, 1:25pm UTC](https://discuss.elastic.co/t/using-dissect-dynamicly-on-filepath/249663/2 "2020-09-23T13:25:41Z")

</div>

You could make a copy of the filename using mutate+add\_field, then use mutate+gsub to remove filename- and .log, then use mutate+split to divide the list of tags into an array. If there is a possibility that the [tags] field already exists then I think you would need to use a ruby filter to merge the two arrays.

---

<div class="post-metadata">

**Author:** ![ThePreMan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thepreman/32/82548_2.png) [@ThePreMan](https://discuss.elastic.co/u/ThePreMan)\
**Post date:** [September 23, 2020, 1:37pm UTC](https://discuss.elastic.co/t/using-dissect-dynamicly-on-filepath/249663/3 "2020-09-23T13:37:41Z")

</div>

That sounds good. That way I could also put the filename without the path into an extra field.  
Thank you I will try that

---

<div class="post-metadata">

**Author:** ![ThePreMan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thepreman/32/82548_2.png) [@ThePreMan](https://discuss.elastic.co/u/ThePreMan)\
**Post date:** [September 24, 2020, 7:49am UTC](https://discuss.elastic.co/t/using-dissect-dynamicly-on-filepath/249663/4 "2020-09-24T07:49:03Z")

</div>

How do you remove things wich gsub. In the gsub section within the mutate doc it only states it to replace certain characters .  
What I did do:

```auto
 mutate {
   convert => {
     "PTimestamp" => "integer"
     "Count" => "integer"
     "Index" => "integer"
     "#Args" => "integer"
     "SessionID" => "integer"
   }
   copy => {
     "log.file.path" => "NameTags"
   }
   gsub {
     "Filename", "/", " "

   }
   split => { "NameTags" => "," }
   add_tag => ["foo_%{NameTags}"]
 }

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 24, 2020, 1:45pm UTC](https://discuss.elastic.co/t/using-dissect-dynamicly-on-filepath/249663/5 "2020-09-24T13:45:55Z")

</div>

> [@ThePreMan](#):
>
> How do you remove things wich gsub.

If you have a field that contains 'filename-tag1-tag2-tag3-tag4-tagN.log' then you can remove parts of it using

```
mutate { gsub => ["someField", "filename-", "", "someField", "\.log", ""] }

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 22, 2020, 1:45pm UTC](https://discuss.elastic.co/t/using-dissect-dynamicly-on-filepath/249663/6 "2020-10-22T13:45:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.