hostname regex path help

[tiernan]

I have files in a directory like this:
/home/user/files/servername_01020304050607.log
How can I get the servername only?

[dwaddle]

This is a good job for host_regex, which is an option in inputs.conf. A host_regex similar to this should work for newly indexed data. (It won't fix previously indexed data is my point)

[monitor:///home/user/files]
host_regex=^/home/user/files/([^_]+)_\d+\.log$

[sbrant_tt]

This should do it:

^/\w+/\w+/\w+/(?<server>\w+)_