# Categorize files in graylog

**URL:** <https://community.graylog.org/t/categorize-files-in-graylog/520>\
**Category:** Graylog Central (peer support)\
**Created:** [March 20, 2017, 11:58pm UTC](https://community.graylog.org/t/categorize-files-in-graylog/520 "2017-03-20T23:58:28Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ryz.namathp](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ryz.namathp/32/94_2.png) [@ryz.namathp](https://community.graylog.org/u/ryz.namathp)\
**Post date:** [March 20, 2017, 11:58pm UTC](https://community.graylog.org/t/categorize-files-in-graylog/520/1 "2017-03-20T23:58:28Z")

</div>

Here is my usecase, I have only one input and logs harvesting from different application lets take tomcat, tomcat have files like catalina.out, access.log, tomcat.out etc, i want to group all these files into one, example SOURCE\_TYPE=tomcat

I should be able to search all above there files with this string SOURCE\_TYPE=tomcat , any suggestion ???

---

<div class="post-metadata">

**Author:** ![harryw](https://avatars.discourse-cdn.com/v4/letter/h/977dab/32.png) [@harryw](https://community.graylog.org/u/harryw)\
**Post date:** [March 21, 2017, 1:52am UTC](https://community.graylog.org/t/categorize-files-in-graylog/520/2 "2017-03-21T01:52:42Z")

</div>

HI.

The method I use is to get nxlog to add a new field called (for me ‘sourcetype’).  
This is configured in nxlog input configuration for a collector.  
For example for my IIS logs …

Exec $size = size($raw\_event);  
Exec if $raw\_event =~ /^#/ drop();   
else   
{   
w3c-\>parse\_csv();   
$EventTime = parsedate($date + " " + $time);   
$EventTime = strftime($EventTime, “%Y-%m-%dT%H:%M:%SZ”);   
$sourcetype = “fred”;   
}

Then you can search for ‘sourcetype=fred’

---

<div class="post-metadata">

**Author:** ![ryz.namathp](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ryz.namathp/32/94_2.png) [@ryz.namathp](https://community.graylog.org/u/ryz.namathp)\
**Post date:** [March 21, 2017, 3:55am UTC](https://community.graylog.org/t/categorize-files-in-graylog/520/3 "2017-03-21T03:55:20Z")

</div>

Thanks @harryw, I am using filebeat , any idea how to make this with filebeat

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [March 21, 2017, 8:42am UTC](https://community.graylog.org/t/categorize-files-in-graylog/520/4 "2017-03-21T08:42:51Z")

</div>

when you are using filebeat you have a field that includes the source of logfile. This is in the field ‘file’ and you can create a pipeline that generate what you like.

---

<div class="post-metadata">

**Author:** ![ryz.namathp](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ryz.namathp/32/94_2.png) [@ryz.namathp](https://community.graylog.org/u/ryz.namathp)\
**Post date:** [March 21, 2017, 5:20pm UTC](https://community.graylog.org/t/categorize-files-in-graylog/520/5 "2017-03-21T17:20:47Z")

</div>

In beats input confiuration, we can add fields and value in key value pair , its getting added to each message, I think we can use this itself without using pipeline (BTW I didnt understood how to use pipeline in this usecase), is there disadvantage by using this way, I know, I need to configure multiple beats inputs in this case, anything else ???