Grok: How to loop and number the field consecutively

Elastic Stack Logstash
1

Hi all,

I am looking at a part of my log-file. I already took this out timestamp etc and it would be too long to post it here. Now part of the interessting message are separated with pipes. I try to get the different fields out. My problem is that sometimes (not always) there are repetitions and they are defined by the second field with a value counting up. (example: OBR|1 then OBR|2...).

SPM||47670^88713|
OBR|1|123|additionalField|
OBR|2|456|
OBR|3|8431|

My current filter:
SPM\|((?<SPMfield1>[^|\r\n]*))?(\|)?((?<SPMfield2>[^|\r\n]*))?(\|)?((?<SPMfield3>[^|\r\n]*))?[\r\n](OBR\|((?<OBRfield1>[^|\r\n]*))?(\|)?((?<OBRfield2>[^|\r\n]*))?(\|)?((?<OBRfield3>[^|\r\n]*))?(\|)?((?<OBRfield4>[^|\r\n]*))?(\|)?)?

Which gets me:

{
  "SPMfield1": [
    ""
  ],
  "SPMfield2": [
    "47670^88713"
  ],
  "SPMfield3": [
    ""
  ],
  "OBRfield1": [
    "1"
  ],
  "OBRfield2": [
    "123"
  ],
  "OBRfield3": [
    "additionalField"
  ],
  "OBRfield4": [
    ""
  ]
}

Ok so I have the first SPM and OBR fields, but I want all the three OBR fields.

Optimally I would get something out like:
OBRfield1-1:
then
OBRfield1-2:.... etc. Counting up by itself.

Thanks alot

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.