# Grok pattern for dynamic field

**URL:** <https://discuss.elastic.co/t/grok-pattern-for-dynamic-field/156490>\
**Category:** Elasticsearch\
**Created:** [November 13, 2018, 2:24pm UTC](https://discuss.elastic.co/t/grok-pattern-for-dynamic-field/156490 "2018-11-13T14:24:29Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![satyaban](https://avatars.discourse-cdn.com/v4/letter/s/bc8723/32.png) [@satyaban](https://discuss.elastic.co/u/satyaban)\
**Post date:** [November 13, 2018, 2:24pm UTC](https://discuss.elastic.co/t/grok-pattern-for-dynamic-field/156490/1 "2018-11-13T14:24:29Z")

</div>

I have some log file having pattern like  
Platform = iOS || iOSRegdID = 1034 || Status = Login || LoggedIn successfully  
Platform = Android || AndroidRegdID = 1024 || **Status = Login** || LoggedIn successfully  
Platform = iOS || iOSRegdID = 104 || Status = Login || LoggedIn successfully  
Platform = Android || AndroidRegdID = 1024 || Logout successfully  
Platform = iOS || iOSRegdID = 1044 || Status = Login || LoggedIn successfully

Here when _ **Plat form is iOS second field is RegID where as if platform is android then it is AndroidRegID** _ so how can I write grok pattern for same to get values for RegID

Again most wired thing when app logout then **Status filed is absent** so how to handle all those scenario sothat I can have a proper dashboard at Kibana.

Kindly help whether it is possible or not .

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 13, 2018, 11:23pm UTC](https://discuss.elastic.co/t/grok-pattern-for-dynamic-field/156490/2 "2018-11-13T23:23:09Z")

</div>

Please don't post the same question across multiple categories - [Grok Pattern for Specific words in side message field](https://discuss.elastic.co/t/grok-pattern-for-specific-words-in-side-message-field/156414)

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 13, 2018, 11:23pm UTC](https://discuss.elastic.co/t/grok-pattern-for-dynamic-field/156490/3 "2018-11-13T23:23:13Z")

</div>


