Add_field in filebeat individuell for each pattern

Elastic Stack Beats
1

Dear All,
my environment is ES and filebeat version 8.17.1 to analyse log files.
In "pipeline.yml" I have a setup like this

- grok:
    field: message
    patterns:
      - 'grok pattern 1'
      - 'some grok pattern 2'
      - 'and many more '

For statistical reasons I would like to add a field individuell to each pattern so that I can later on count which patterns are used how often. And also to bring often used patterns in front.
Is there a way to do so ? If yes, how ?

Kind regards
Hans

2

Just want to answer my own question, found now a solution.
Very simple. I take the first space and instead of using the blank character I used %{SPACE:pattern01} and so on for the next pattern 02 ... .

- grok:
    field: message
    patterns:
      - 'grok%{SPACE:pattern01}pattern 1'
      - 'some%{SPACE:pattern02}grok pattern 2'
      - 'and%{SPACE:pattern03}many more '

Kind regards
Hans

.