# How to dissect/script/grok a long number into different fields using regex in an ingest pipeline?

**URL:** <https://discuss.elastic.co/t/how-to-dissect-script-grok-a-long-number-into-different-fields-using-regex-in-an-ingest-pipeline/300653>\
**Category:** Kibana\
**Tags:** ingest-pipeline\
**Created:** [March 25, 2022, 2:01am UTC](https://discuss.elastic.co/t/how-to-dissect-script-grok-a-long-number-into-different-fields-using-regex-in-an-ingest-pipeline/300653 "2022-03-25T02:01:48Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Patr123](https://avatars.discourse-cdn.com/v4/letter/p/ac91a4/32.png) [@Patr123](https://discuss.elastic.co/u/Patr123)\
**Post date:** [March 25, 2022, 2:01am UTC](https://discuss.elastic.co/t/how-to-dissect-script-grok-a-long-number-into-different-fields-using-regex-in-an-ingest-pipeline/300653/1 "2022-03-25T02:01:48Z")

</div>

Hello,  
I have a number which needs to be dissected into different fields using regex. I think It needs to be regex because the first set of number changes in length.  
I have been struggling to find a similar example anywhere, so can anyone help me in this?

My number field is like:

```auto
123400000123000056781

```

This needs to be separated into different fields like:

```auto
field1: 1234
field2: 00000
field3: 123
field4: 0000
field5: 5678
field6: 1

```

Sometime the field1 can have 1-4 digits. Field2 will always have 5 zeros, field3 will always 3 digits, field4 will always have 4 zeros, field 5 will always have 4 digits and then field 6 will always be a number 1 which indicates the end of string.

Thank you.

---

<div class="post-metadata">

**Author:** ![angelo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/angelo/32/61325_2.png) [@angelo](https://discuss.elastic.co/u/angelo)\
**Post date:** [March 26, 2022, 10:05pm UTC](https://discuss.elastic.co/t/how-to-dissect-script-grok-a-long-number-into-different-fields-using-regex-in-an-ingest-pipeline/300653/2 "2022-03-26T22:05:37Z")

</div>

I'm going to assume you don't need fields 2, 4 and 6 since you know that they will always be what you noted (00000, 0000, 1) and could set them directly if needed ... so that leaves just the other 3 fields.

For dissect: `%{field1}00000%{field3}0000%{field5}1`  
For grok: `(?<field1>(?>\d){4,5})00000(?<field3>(?>\d){3})0000(?<field5>(?>\d){4})1`

NOTE: I didn't actually try these out in Logstash, I only quickly tested these in the online [dissect](https://dissect-tester.jorgelbg.me/) tester and [grok](https://grokdebug.herokuapp.com/) debugger.

---

<div class="post-metadata">

**Author:** ![Patr123](https://avatars.discourse-cdn.com/v4/letter/p/ac91a4/32.png) [@Patr123](https://discuss.elastic.co/u/Patr123)\
**Post date:** [March 27, 2022, 3:33am UTC](https://discuss.elastic.co/t/how-to-dissect-script-grok-a-long-number-into-different-fields-using-regex-in-an-ingest-pipeline/300653/3 "2022-03-27T03:33:30Z")

</div>

Hello Angelo,  
Thank you so much. Yes, you are absolutely right and I don't need the field #2, 4 and 6.  
I tried the dissect filter and it works great only if the ending digit of the field1 is not ending with 0. If it ends with 0 then for some reason that 0 is added to the field3 which is not we want.  
The grok pattern works in the grok debugger and dev tools but I am not able to add the same pattern in the ingest pipeline and its giving me a "Invalid JSON String" error message.

But your grok pattern helped me in creating my own regex in the following format:

```auto
(?<field1>([0-9]{1,4}))(?<field2>([0-9]{5}))(?<field3>([0-9]{3}))(?<field4>([0-9]{4}))(?<field5>([0-9]{4}))(?<field6>([0-9]{1}))

```

and I was able to get the result I needed.

Now that it works:  
I can use this regex too:

```auto
(?<field1>([0-9]{1,4}))(?<field2>([0]{5}))(?<field3>([0-9]{3}))(?<field4>([0]{4}))(?<field5>([0-9]{4}))(?<field6>([1]{1}))

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 24, 2022, 3:33am UTC](https://discuss.elastic.co/t/how-to-dissect-script-grok-a-long-number-into-different-fields-using-regex-in-an-ingest-pipeline/300653/4 "2022-04-24T03:33:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.