# Using filebeat and add job name

**URL:** <https://discuss.elastic.co/t/using-filebeat-and-add-job-name/143238>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 7, 2018, 5:48am UTC](https://discuss.elastic.co/t/using-filebeat-and-add-job-name/143238 "2018-08-07T05:48:39Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Divit\_Sharma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/divit_sharma/32/32348_2.png) [@Divit\_Sharma](https://discuss.elastic.co/u/Divit_Sharma)\
**Post date:** [August 7, 2018, 5:48am UTC](https://discuss.elastic.co/t/using-filebeat-and-add-job-name/143238/1 "2018-08-07T05:48:39Z")

</div>

I have the below log structure of jobs:  
/job1/datetoday.log  
/job2/datetoday.log  
and so on.

Can file beat be used to grep the error in logs and add Job name string to that error log fetched before indexing to ES so that in kibana I can search the log by job name.

I need help mainly for adding job name file to each grep'd error. It would be something like this:  
Job1 Error.....  
Job1 Error...  
Job2 Error  
Job3 Error and so on.

The job name has to be fetched from the folder structure for writing. Please help

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [August 7, 2018, 3:04pm UTC](https://discuss.elastic.co/t/using-filebeat-and-add-job-name/143238/2 "2018-08-07T15:04:56Z")

</div>

Hi @Divit_Sharma,

Source path is sent as part of the event, in the `source` field. This can already be used to search by this name.  
In any case you can modify events with [an ingest pipeline](https://www.elastic.co/guide/en/beats/filebeat/current/configuring-ingest-node.html), with this you could parse the `source` field to extract the name of the job from the log file path, and then adding it as a new field that you can then use to filter events in Kibana.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 4, 2018, 3:05pm UTC](https://discuss.elastic.co/t/using-filebeat-and-add-job-name/143238/3 "2018-09-04T15:05:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.