How to Add the File Name as a Field in Logstash?

Better Stack Team
Updated on April 4, 2024

If you're dealing with log entries from multiple files and want to dynamically add the file path to each log event to identify its source, you can achieve this using Logstash. Here's how:

You can use the Dissect filter plugin, as follows:

filter {
  dissect {
    mapping => { "path" => "%{directory}/%{filename}.log" }

This configuration will dynamically add a path field to the filename.

Consequently, the log event will be augmented to include a field like this:

  "log": {
    "file": {
      "path": "/var/log/logify/app.log"

Alternatively, you can employ the grok filter:

filter {
  grok {
    match => ["path","%{GREEDYDATA}/%{GREEDYDATA:filename}\.log"]

This approach achieves the same outcome by extracting the filename from the path.

To further explore Logstash, refer to our comprehensive guide.

Got an article suggestion? Let us know
Explore more
Licensed under CC-BY-NC-SA

This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.

Make your mark

Join the writer's program

Are you a developer and love writing and sharing your knowledge with the world? Join our guest writing program and get paid for writing amazing technical guides. We'll get them to the right readers that will appreciate them.

Write for us
Writer of the month
Marin Bezhanov
Marin is a software engineer and architect with a broad range of experience working...
Build on top of Better Stack

Write a script, app or project on top of Better Stack and share it with the world. Make a public repository and share it with us at our email.

or submit a pull request and help us build better products for everyone.

See the full list of amazing projects on github