find which event belong to which file in compress file

[indeed_2000]

Hi

I have compress file that contain several files. in source just show compress file. e.g compress files name is log.bz2,  it contain log1 log2 log3

currently in source just show log.bz2 , how can I find which event belong to which file?

something like this  log.bz2 > log2

Any idea?

thanks

[tscroggins]

@indeed_2000 

How did you define your monitor input? What kind of archive is log.bz2? Source would typically have a value like /path/to/log.bz2:./log1, /path/to/log.bz2:./log2, /path/to/log.bz2:./log3, etc.

To replace source with the archived source path:

| rex field=source ":(?!\\\\)(?<source>.*)"

To replace source with the archived source file:

| rex field=source ".*[\\\\/](?<source>.*)"