Add the input filename to a Logstash event

The file input adds the source path to each event. With ECS enabled, read [log][file][path]; with ECS disabled, read path. Extract the final component to make the filename available for searches or routing.

Extract a filename with grok

This example explicitly enables ECS v8 and reads Unix-style paths:

input {
  file {
    path => "/var/log/app/*.log"
    start_position => "beginning"
    ecs_compatibility => "v8"
  }
}
filter {
  grok {
    match => { "[log][file][path]" => "/(?<filename>[^/]+)$" }
  }
}

The anchored final component accepts spaces in names such as order worker.log. start_position affects files without an existing sincedb position; it does not force already tracked files to be replayed.

To capture the name without a .log suffix, replace the match with:

grok {
  match => { "[log][file][path]" => "/(?<filename_base>[^/]+)[.]log$" }
}

The suffix is case-sensitive. For Windows-style paths, the regex engine must receive [\\/] as the separator class. Quoting and backslash processing depend on config.support_escapes, so test both slash styles with the exact deployed configuration.

Use the filename for routing

Avoid putting arbitrary filenames directly into Elasticsearch index names: uppercase letters and other characters can make them invalid. Map known filenames to controlled prefixes and provide a fallback:

filter {
  if [filename] == "order.log" {
    mutate { add_field => { "[@metadata][index_prefix]" => "orders" } }
  } else {
    mutate { add_field => { "[@metadata][index_prefix]" => "app-other" } }
  }
}
output {
  elasticsearch {
    hosts => ["http://es:9200"]
    ilm_enabled => false
    data_stream => false
    index => "%{[@metadata][index_prefix]}-%{+yyyy.MM.dd}"
  }
}

This example deliberately writes ordinary daily indices. Configure authentication, TLS, templates, and retention for your cluster. The date comes from @timestamp, not the filename. Sincedb affects which bytes are read; it does not remove the path from newly emitted events.

References

• Elastic: inputs file
• Elastic: filters grok
• Elastic: outputs elasticsearch