# Ingest: foreach + grok processor - how to write result into an array?

**URL:** <https://discuss.elastic.co/t/ingest-foreach-grok-processor-how-to-write-result-into-an-array/90281>\
**Category:** Elasticsearch\
**Created:** [June 21, 2017, 12:09pm UTC](https://discuss.elastic.co/t/ingest-foreach-grok-processor-how-to-write-result-into-an-array/90281 "2017-06-21T12:09:17Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jarda-manana](https://avatars.discourse-cdn.com/v4/letter/j/d78d45/32.png) [@jarda-manana](https://discuss.elastic.co/u/jarda-manana)\
**Post date:** [June 21, 2017, 12:09pm UTC](https://discuss.elastic.co/t/ingest-foreach-grok-processor-how-to-write-result-into-an-array/90281/1 "2017-06-21T12:09:17Z")

</div>

Hi,  
I'm trying to use grok processor within a foreach processor, but I'm failing. I don't know how to write new sub-fields in grok processor.

Example document:

```
{
     "f": ["a 1", "b 2"]
}

```

Wanted result:

```
{
     "f": ["a 1", "b 2"],
     "f.word": ["a", "b"],
     "f.number": [1, 2]
 }

```

Or:

```
{
    "f": [
            {"word": "a",
             "number": 1},
            {"word": "b",
              "number": 2}
           ]
}

```

Is something like this achievable? Thanks...

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 19, 2017, 12:09pm UTC](https://discuss.elastic.co/t/ingest-foreach-grok-processor-how-to-write-result-into-an-array/90281/2 "2017-07-19T12:09:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.