# Add\_field in filebeat individuell for each pattern

**URL:** <https://discuss.elastic.co/t/add-field-in-filebeat-individuell-for-each-pattern/373742>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 27, 2025, 5:49pm UTC](https://discuss.elastic.co/t/add-field-in-filebeat-individuell-for-each-pattern/373742 "2025-01-27T17:49:14Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mayer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mayer/32/42164_2.png) [@mayer](https://discuss.elastic.co/u/mayer)\
**Post date:** [January 27, 2025, 5:49pm UTC](https://discuss.elastic.co/t/add-field-in-filebeat-individuell-for-each-pattern/373742/1 "2025-01-27T17:49:15Z")

</div>

Dear All,  
my environment is ES and filebeat version 8.17.1 to analyse log files.  
In "pipeline.yml" I have a setup like this

```auto
- grok:
    field: message
    patterns:
      - 'grok pattern 1'
      - 'some grok pattern 2'
      - 'and many more ' 

```

For statistical reasons I would like to add a field individuell to each pattern so that I can later on count which patterns are used how often. And also to bring often used patterns in front.  
Is there a way to do so ? If yes, how ?

Kind regards  
Hans

---

<div class="post-metadata">

**Author:** ![mayer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mayer/32/42164_2.png) [@mayer](https://discuss.elastic.co/u/mayer)\
**Post date:** [January 29, 2025, 8:55pm UTC](https://discuss.elastic.co/t/add-field-in-filebeat-individuell-for-each-pattern/373742/2 "2025-01-29T20:55:51Z")

</div>

Just want to answer my own question, found now a solution.  
Very simple. I take the first space and instead of using the blank character I used `%{SPACE:pattern01}` and so on for the next pattern 02 ... .

```auto
- grok:
    field: message
    patterns:
      - 'grok%{SPACE:pattern01}pattern 1'
      - 'some%{SPACE:pattern02}grok pattern 2'
      - 'and%{SPACE:pattern03}many more '

```

Kind regards  
Hans

.