# Limits on Grok/Split ingest processing

**URL:** <https://discuss.elastic.co/t/limits-on-grok-split-ingest-processing/255168>\
**Category:** Elasticsearch\
**Created:** [November 12, 2020, 8:35am UTC](https://discuss.elastic.co/t/limits-on-grok-split-ingest-processing/255168 "2020-11-12T08:35:25Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![aceggroll](https://avatars.discourse-cdn.com/v4/letter/a/bbe5ce/32.png) [@aceggroll](https://discuss.elastic.co/u/aceggroll)\
**Post date:** [November 12, 2020, 8:35am UTC](https://discuss.elastic.co/t/limits-on-grok-split-ingest-processing/255168/1 "2020-11-12T08:35:25Z")

</div>

I need some advice on whether I have come to the limits of ingest processing, or maybe there is another option.  
We're using ES 7.9.3, and receiving logs with winlogbeat. (Logstash is not in play)  
The logs I'm interested in are from an email system, have multiline content, and include a list of recipients, over multiple lines. (multiline means one string with \n characters.)  
Each recipient in the list has multiple attributes (eg address and name).

Is it possible to generate an array of recipients, eg  
**from:**

```auto
"message": " ... \nRecipients\nRecipient\nName:Alice\nAddress:alice@example.com\nRecipient\nName:Bob\nAddress:bob@example.org\n"

```

**to:**

```auto
    "recipients": [
      { "name": "alice", "address": "alice@example.com" },  
      { "name": "bob", "address": "bob@example.org" }
    ]  

```

Is it possible to do the above? Samples would be great.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 10, 2020, 8:35am UTC](https://discuss.elastic.co/t/limits-on-grok-split-ingest-processing/255168/2 "2020-12-10T08:35:33Z")

</div>

Closed on December 10, 2020, 8:35am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.