Hybrid Grok and Dissect Parsing

[Nico_Pampaloni]

Hi Everyone! I have a question about using Dissect and Grok together when working with a format that has varying structure. A line in my log file might look like this:

word,word.word.word.word|timestamp|number,number,name|timestamp

However the number of names in a line can change so it may also look like:

word,word.word.word.word|timestamp|number,number,name|name|name|timestamp

For log files with the same structure but only single names in them, I am using Dissect to parse the different fields and it's working great. For this specific log with a varying number of names in it, I can't seem to find a way to use Dissect and Grok together to make this work.

Any suggestions would be greatly appreciated.
Thanks!

[Badger]

Use dissect to parse the fixed prefix and grok with an array of patterns for the variable part. An example is here.

[Nico_Pampaloni]

Thanks for the response!! That's super helpful. My only issue now is how to get Grok to deal with a varying number of name fields.