How to split file name in logstash?

Question

I am injecting a file from the s3 bucket to logstash, My file name is containing some information, I want to split the file name into multiple fields, so I can use them as separate fields. Please help me I am new with elk.

input {
 s3 {
    bucket => "***********"
    access_key_id => "***********"
    secret_access_key => "*******"
    "region" => "*********"
    
    "prefix" => "Logs"
    "interval" => "1"
    "additional_settings" => {
           "force_path_style" => true
           "follow_redirects" => false
           }
    }
}

filter {
  mutate {
    add_field => {
      "file" => "%{[@metadata][s3][key]}"              //This file name have to split
    }
   
  }
}

output {
 elasticsearch {
  hosts => ["localhost:9200"]
  index => "indexforlogstash"
     
 }
}

Answer 1

In the filter section you can leverage the dissect filter in order to achieve what you want:

filter {
    ...

    dissect {
      mapping => {
        "file" => "Logs/%{deviceId}-%{buildId}-log.txt"
      }
    }
}

After going through this filter, your document is going to get two new fields, namely:

• deviceId (1232131)
• buildId (custombuildv12)