title: Can't create a field with a variable from a grok match regex
body: <p>I am currently using logstash, elasticsearch and kibana 6.3.0</p>
  
  <p>My log are generated at a unique id path : /tmp/USER_DATA/FactoryContainer/images/(my unique id)/oar/oar_image_job(my unique id).stdout</p>
  
  <p>What I want to do is to match this unique id and to create a field with this id. </p>
  
  <p>I m a bit novice to logstash filter but I don't know why it doesn't want to use my uid and always return me %{uid} in my field or this Failed to execute action error.</p>
  
  <p>my filter :</p>
  
  <pre><code>input {
    file {
      path =&gt; "/tmp/USER_DATA/FactoryContainer/images/*/oar/oar_image_job*.stdout"
      start_position =&gt; "beginning"
      add_field =&gt; { "data_source" =&gt; "oar-image-job" }
     }
  }
  
  filter {
      grok {
          match =&gt; ["path","%{UNIXPATH}%{NUMBER:uid}%{UNIXPATH}"]
      }
      mutate {
          add_field =&gt; [ "unique_id" =&gt; "%{uid}" ]
      }
  }
  
  output {
    if [data_source] == "oar-image-job" {
      elasticsearch {
          index =&gt; "oar-image-job-%{+YYYY.MM.dd}"
          hosts =&gt; ["localhost:9200"]
          }
      }
  }
  </code></pre>
  
  <p>the data_source field is to avoid this issue: When you put multiple config files in a directory for Logstash to use, they will all be concatenated</p>
  
  <p>in the grok debugger %{UNIXPATH}%{NUMBER:uid}%{UNIXPATH} my path return me the good value </p>