# Dynamic fields name within grok match
**URL:** https://discuss.elastic.co/t/dynamic-fields-name-within-grok-match/287150
**Category:** Logstash
**Created:** [October 20, 2021, 3:20am UTC](https://discuss.elastic.co/t/dynamic-fields-name-within-grok-match/287150 "2021-10-20T03:20:43Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@paska](https://discuss.elastic.co/u/paska)
#### Post date: [October 20, 2021, 3:20am UTC](https://discuss.elastic.co/t/dynamic-fields-name-within-grok-match/287150/1 "2021-10-20T03:20:43Z")
Hello. I'm wanted to use dynamic fields name within grok match. But I couldn't find any information about it and about correct syntax.
First of all I'm getting field, which depends on field log.file.path
```auto
grok {
match => { "log.file.path" => "(?((?<=logs\/)(\w*)(?=\/)|(?<=logs\/)(\w*)(?=.*\.)))" }
}
```
In the next step, I want to use value of log\_prefix field as a part of new field:
```auto
grok {
match => { "message" => "%{DATESTAMP:dev.%{log_prefix}.timestamp}] (?production\.[A-Z]{3,9}|local\.[A-Z]{3,9}): (?(.|\r|\n)*)"}
}
```
So, in this case, I've got error \. Of course I understand why. Is there any suggestion how I can do this correctly? Thanks.
---
### Author:  [@Cad](https://discuss.elastic.co/u/Cad)
#### Post date: [October 20, 2021, 12:36pm UTC](https://discuss.elastic.co/t/dynamic-fields-name-within-grok-match/287150/2 "2021-10-20T12:36:37Z")
Hi,
You should put the values in static fields and create the dynamic fields with the `add_field` option of the grok filter.
The code need to be like this i think:
```auto
grok {
match => { "log.file.path" => "(?((?<=logs\/)(\w*)(?=\/)|(?<=logs\/)(\w*)(?=.*\.)))" }
}
grok {
match => { "message" => "%{DATESTAMP:tmp1}] (?production\.[A-Z]{3,9}|local\.[A-Z]{3,9}): (?(.|\r|\n)*)"}
#add_field executed only if the filter is successful
add_field => {
"dev.%{log_prefix}.timestamp" => "%{tmp1}"
"dev.%{log_prefix}.loglevel" => "%{tmp2}"
"dev.%{log_prefix}.message" => "%{tmp3}"
}
}
```
Cad.
---
### Author:  [@paska](https://discuss.elastic.co/u/paska)
#### Post date: [October 21, 2021, 2:52am UTC](https://discuss.elastic.co/t/dynamic-fields-name-within-grok-match/287150/3 "2021-10-21T02:52:41Z")
Hi. Thanks for your solution. I've found another one for me. But it's similar. Instead of using "add\_fields" I decided to use "mutate" filter to rename temporary fields.
```auto
grok {
match => { "log.file.path" => "(?((?<=logs\/)(\w*)(?=\/)|(?<=logs\/)(\w*)(?=.*\.)))" }
}
grok {
match => { "message" => "%{DATESTAMP:temp.timestamp}](\[(?[0-9]*)\])? (?production\.[A-Z]{3,9}|local\.[A-Z]{3,9}|Processing|Processed|Failed): (?(.|\r|\n)*[^\n]+)"}
}
mutate {
rename => { "temp.timestamp" => "%{server_type}.%{log_prefix}.timestamp" }
rename => { "temp.loglevel" => "%{server_type}.%{log_prefix}.loglevel" }
rename => { "temp.message" => "%{server_type}.%{log_prefix}.message" }
rename => { "temp.thread" => "%{server_type}.%{log_prefix}.thread" }
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 18, 2021, 2:53am UTC](https://discuss.elastic.co/t/dynamic-fields-name-within-grok-match/287150/4 "2021-11-18T02:53:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.