# How to match and assign fields to a dynamic number of key values of the same name

**URL:** <https://discuss.elastic.co/t/how-to-match-and-assign-fields-to-a-dynamic-number-of-key-values-of-the-same-name/155777>\
**Category:** Logstash\
**Created:** [November 7, 2018, 7:09pm UTC](https://discuss.elastic.co/t/how-to-match-and-assign-fields-to-a-dynamic-number-of-key-values-of-the-same-name/155777 "2018-11-07T19:09:03Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ryan\_Clark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ryan_clark/32/44467_2.png) [@Ryan\_Clark](https://discuss.elastic.co/u/Ryan_Clark)\
**Post date:** [November 7, 2018, 7:09pm UTC](https://discuss.elastic.co/t/how-to-match-and-assign-fields-to-a-dynamic-number-of-key-values-of-the-same-name/155777/1 "2018-11-07T19:09:04Z")

</div>

In the auditd event below, there are two path names that need to be captured (name="/tmp" and name="file"). There could be multiple entries for the path name depending on the path accessed. I need to be able to dynamically pull these path names into a field or fields to get the full path for the event. How would I build a grok match for this?

What I have so far that only gets one path is:

> grok {  
> match =\> { "message" =\> ".\*syscall=%{WORD:access\_type}.\*auid=%{USERNAME:ANAME} uid=%{USERNAME:UNAME}._name=%{DATA:path}._%{GREEDYDATA}" }  
> }

Event String:  
type=SYSCALL msg=audit(1316210542.899:779): arch=c000003e syscall=263 success=yes exit=0 a0=3 a1=400690 a2=0 a3=0 items=2 ppid=32106 pid=32121 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts12 ses=36 comm="unlinkat" exe="/tmp/unlinkat" key=(null) type=CWD msg=audit(1316210542.899:779): cwd="/tmp" type=PATH msg=audit(1316210542.899:779): item=0 name="/tmp" inode=58781 dev=00:0e mode=040755 ouid=1000 ogid=1000 rdev=00:00 type=PATH msg=audit(1316210542.899:779): item=1 name="file" inode=56228 dev=00:0e mode=0100644 ouid=1000 ogid=1000 rdev=00:00 type=EOE msg=audit(1316210542.899:779):

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [November 7, 2018, 7:28pm UTC](https://discuss.elastic.co/t/how-to-match-and-assign-fields-to-a-dynamic-number-of-key-values-of-the-same-name/155777/2 "2018-11-07T19:28:58Z")

</div>

Have you tried using the [kv filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html)?

---

<div class="post-metadata">

**Author:** ![Ryan\_Clark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ryan_clark/32/44467_2.png) [@Ryan\_Clark](https://discuss.elastic.co/u/Ryan_Clark)\
**Post date:** [November 7, 2018, 7:31pm UTC](https://discuss.elastic.co/t/how-to-match-and-assign-fields-to-a-dynamic-number-of-key-values-of-the-same-name/155777/3 "2018-11-07T19:31:36Z")

</div>

I'm aware of kv but havn't tried it because I would end up with a lot of fields I don't care for. I guess I could always remove them. If there is not a dynamic way to do this in a grok match then I'll go that route.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [November 7, 2018, 7:46pm UTC](https://discuss.elastic.co/t/how-to-match-and-assign-fields-to-a-dynamic-number-of-key-values-of-the-same-name/155777/4 "2018-11-07T19:46:29Z")

</div>

The kv filter will handle the fields no matter in which order they come, so is quite flexible.

---

<div class="post-metadata">

**Author:** ![Ryan\_Clark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ryan_clark/32/44467_2.png) [@Ryan\_Clark](https://discuss.elastic.co/u/Ryan_Clark)\
**Post date:** [November 7, 2018, 9:46pm UTC](https://discuss.elastic.co/t/how-to-match-and-assign-fields-to-a-dynamic-number-of-key-values-of-the-same-name/155777/5 "2018-11-07T21:46:33Z")

</div>

I did have to remove about 30+ fields that weren't needed but using kv seems to work. Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 5, 2018, 9:46pm UTC](https://discuss.elastic.co/t/how-to-match-and-assign-fields-to-a-dynamic-number-of-key-values-of-the-same-name/155777/6 "2018-12-05T21:46:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.