Logstash: how to use filter to match filename when using s3
问题 I am new to logstash. I have some logs stored in AWS S3 and I am able to import them to logstash. My question is: is it possible to use the grok filter to add tags based on the filenames? I try to use: grok { match => {"path" => "%{GREEDYDATA}/%{GREEDYDATA:bitcoin}.err.log"} add_tag => ["bitcoin_err"] } This is not working. I guess the reason is "path" only working with file inputs. Here is the structure of my S3 buckets: my_buckets ----A ----2014-07-02 ----a.log ----b.log ----B ----2014-07