Use grok to add the log filename as a field in logstash

Question

I\'m using Grok & Logstash to send access logs from Nginx to Elastic search. I\'m giving Logstash all my access logs (with a wildcard, works well) and I would like to get th

Answer 1

I found it more desirable to use 2 grok blocks if there will be unmatching lines in the log files.

filter {
  if [type] == "nginx_access" {
    grok { 
      match => { "path" => "%{GREEDYDATA}/%{GREEDYDATA:app}.access.log" }
    }
    grok { 
      match => { "message" => "%{COMBINEDAPACHELOG}" }
    }
  }
}