Grok: How to loop and number the field consecutively

Hi all,

I am looking at a part of my log-file. I already took this out timestamp etc and it would be too long to post it here. Now part of the interessting message are separated with pipes. I try to get the different fields out. My problem is that sometimes (not always) there are repetitions and they are defined by the second field with a value counting up. (example: OBR|1 then OBR|2...).


My current filter:

Which gets me:

  "SPMfield1": [
  "SPMfield2": [
  "SPMfield3": [
  "OBRfield1": [
  "OBRfield2": [
  "OBRfield3": [
  "OBRfield4": [

Ok so I have the first SPM and OBR fields, but I want all the three OBR fields.

Optimally I would get something out like:
OBRfield1-2:.... etc. Counting up by itself.

Thanks alot

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.