# How processing logs with different structure with logstash

**URL:** https://discuss.elastic.co/t/how-processing-logs-with-different-structure-with-logstash/242401
**Category:** Logstash
**Created:** [July 23, 2020, 8:46pm UTC](https://discuss.elastic.co/t/how-processing-logs-with-different-structure-with-logstash/242401 "2020-07-23T20:46:14Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 23, 2020, 9:47pm UTC](https://discuss.elastic.co/t/how-processing-logs-with-different-structure-with-logstash/242401/2 "2020-07-23T21:47:46Z")

</div>

If you log entries have a standard prefix then I would [normally](https://discuss.elastic.co/t/using-grok-how-to-parse-multiple-entries-with-the-same-field-name/184819/2) suggest picking that off with dissect, then using grok against the various formats of the log.

In this case I would consider doing it with a csv filter.

```
 csv { separator => " " columns => ["COL_01", "COL_02", "COL_03", "COL_04", "[@metadata][restOfLine]" }

```

Then use grok with an array of pattern to match [@metadata][restOfLine]

---

_[View the full topic](https://discuss.elastic.co/t/how-processing-logs-with-different-structure-with-logstash/242401)._