# Grok: How to loop and number the field consecutively

**URL:** <https://discuss.elastic.co/t/grok-how-to-loop-and-number-the-field-consecutively/90161>\
**Category:** Logstash\
**Created:** [June 20, 2017, 8:56pm UTC](https://discuss.elastic.co/t/grok-how-to-loop-and-number-the-field-consecutively/90161 "2017-06-20T20:56:38Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ralf2k](https://avatars.discourse-cdn.com/v4/letter/r/4491bb/32.png) [@Ralf2k](https://discuss.elastic.co/u/Ralf2k)\
**Post date:** [June 20, 2017, 8:56pm UTC](https://discuss.elastic.co/t/grok-how-to-loop-and-number-the-field-consecutively/90161/1 "2017-06-20T20:56:39Z")

</div>

Hi all,

I am looking at a part of my log-file. I already took this out timestamp etc and it would be too long to post it here. Now part of the interessting message are separated with pipes. I try to get the different fields out. My problem is that sometimes (not always) there are repetitions and they are defined by the second field with a value counting up. (example: OBR|1 then OBR|2...).

```
SPM||47670^88713|
OBR|1|123|additionalField|
OBR|2|456|
OBR|3|8431|

```

My current filter:  
`SPM\|((?<SPMfield1>[^|\r\n]*))?(\|)?((?<SPMfield2>[^|\r\n]*))?(\|)?((?<SPMfield3>[^|\r\n]*))?[\r\n](OBR\|((?<OBRfield1>[^|\r\n]*))?(\|)?((?<OBRfield2>[^|\r\n]*))?(\|)?((?<OBRfield3>[^|\r\n]*))?(\|)?((?<OBRfield4>[^|\r\n]*))?(\|)?)?`

Which gets me:

```
{
  "SPMfield1": [
    ""
  ],
  "SPMfield2": [
    "47670^88713"
  ],
  "SPMfield3": [
    ""
  ],
  "OBRfield1": [
    "1"
  ],
  "OBRfield2": [
    "123"
  ],
  "OBRfield3": [
    "additionalField"
  ],
  "OBRfield4": [
    ""
  ]
}

```

Ok so I have the first SPM and OBR fields, but I want all the three OBR fields.

Optimally I would get something out like:  
OBRfield1-1:  
then  
OBRfield1-2:.... etc. Counting up by itself.

Thanks alot

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 18, 2017, 8:56pm UTC](https://discuss.elastic.co/t/grok-how-to-loop-and-number-the-field-consecutively/90161/2 "2017-07-18T20:56:51Z")

</div>

Closed on July 18, 2017, 8:56pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.