Logstash: using date / time in file name as imported field

Question

I have a bunch of log files called "XXXXXX_XX_yymmdd_hh: mm: ss.txt". I need to specify the date and time (separate fields) from the file name in the fields that are added to Logstash.

Can anyone help?

thanks

Answer 1

Use grok filter to extract date and time:

filter { grok { match => [ "path", "^%{GREEDYDATA}/[^/]+_%{INT:date}_%{TIME:time}\.txt$" ] } } 

Depending on what happens instead of XXXXXX_XX, you might prefer a more strict expression. In addition, GREEDYDATA is not very effective. This can lead to increased performance:

 filter { grok { match => [ "path", "^(?:/[^/]+)+/[^/]+_%{INT:date}_%{TIME:time}\.txt$" ] } }