Extract a filename from a Logstash file path

The file input supplies a full source path. Its field is [log][file][path] with ECS enabled and path with ECS disabled. Use the field that actually appears in your event, then extract its final component into a separate field.

Use grok for a Unix path

For an input configured with ecs_compatibility => "v8":

filter {
  grok {
    match => { "[log][file][path]" => "/(?<log_filename>[^/]+)$" }
  }
}

/var/log/app/order-2024-01-15.log produces order-2024-01-15.log. Anchoring the pattern at the end avoids a partial path match, and [^/]+ allows spaces in a filename.

Or split a copied value

When the path is known to use forward slashes, copy it before splitting so you retain the original metadata:

filter {
  if [log][file][path] {
    mutate {
      copy => { "[log][file][path]" => "log_filename" }
    }
    mutate {
      split => { "log_filename" => "/" }
    }
    ruby {
      code => '
        parts = event.get("log_filename")
        if parts.is_a?(Array) && !parts.empty?
          event.set("log_filename", parts.last)
        end
      '
    }
  }
}

Separate mutate blocks make the copy-before-split sequence explicit. The guard avoids calling .last on a missing or unexpected value. For this narrow task, grok is shorter and easier to read.

Use the field without losing its context

A filename helps identify a busy source or extract a date or service identifier encoded in the name. Keep the full path when identical basenames occur in several directories. If using filenames in index routing, validate or map them to controlled names rather than sending arbitrary characters to Elasticsearch.

For Windows separators, the regex engine needs a separator class such as [\\/]; verify string escaping in your deployed Logstash settings. Splitting on / alone will not handle backslash-only paths.

The input's configured path may contain a wildcard, but the event metadata normally identifies the actual file read. A directory-only or missing value calls for inspecting the input and any earlier field transformations. Changing sincedb controls reading positions, not basename extraction.

References

• Elastic: inputs file
• Elastic: filters mutate
• Elastic: filters ruby