Tailing multiple files in multiple directories and using the directory and file name as tags

[MrMMorris]

I have directories within /var/log/app/* that are named based on the env the logs relate to:

/var/log/app/
  ∟dev
  ∟qa
  ∟prod

Within those directories, I have logs for various processes in the form of *.log.1:

/var/log/app/
  ∟dev
      ∟foo.log.1
      ∟bar.log.1
  ∟qa
      ∟foo.log.1
      ∟bar.log.1

Is there a way that I can use the tail plugin and write a single filter so that the directory env becomes one tag and the foo/bar part of the log file name becomes another tag? Or do I need to have one source per file name? So for example, I would want to end up with log_name's such as:

app.dev.foo
app.dev.bar
app.qa.foo
app.qa.bar
app.prod.foo
app.prod.bar

and tags such as:

env: dev
log_type: foo

I figured it would be similar to the docker filter I have:

<source>
  @type tail
  path /var/log/app/*/*.log.1
  pos_file /var/log/td-agent/tmp/app.pos
  time_format %Y-%m-%dT%H:%M:%S
  tag app.*
  <parse>
    @type json
  </parse>
  read_from_head true
</source>

<filter app.**>
  @type record_transformer
  remove_keys tag
  <record>
    env ${tag_parts[2]}
    log_type ${tag_parts[3]}
  </record>
</filter>

but I know the tag_parts aren't actually referencing the directory and files names.

Is there a way to hand all the directories and files within them with one filter? or do I need to just manually create one per directory/file?

[daipom]

but I know the tag_parts aren't actually referencing the directory and files names.

What does this mean?
Doesn't tag app.* include the entire path?

I think the tag will be app.var.log.app.dev.foo.log.1. Isn't it like this?
You can extract whatever you want from this.