How can i parse one field further into different fields in another grok pattern?

Just add another grok filter.

grok {
  match => ["data2", "..."]
}
1 Like