# Logs contains different format of same field name while parsing in logstash

**URL:** https://discuss.elastic.co/t/logs-contains-different-format-of-same-field-name-while-parsing-in-logstash/290103
**Category:** Logstash
**Created:** [November 24, 2021, 6:57pm UTC](https://discuss.elastic.co/t/logs-contains-different-format-of-same-field-name-while-parsing-in-logstash/290103 "2021-11-24T18:57:24Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Divyank\_Mahalle](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/divyank_mahalle/32/91240_2.png) [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)
#### Post date: [November 24, 2021, 6:57pm UTC](https://discuss.elastic.co/t/logs-contains-different-format-of-same-field-name-while-parsing-in-logstash/290103/1 "2021-11-24T18:57:24Z")

</div>

Hi,

I am using logstash to parse logs from txt file.I am having field "mstrGateway" and "MstrGateway" in two different logs, how to parse this field in single "mstrGateway" field.  
If I make two different fields such as "mstrGateway" and "MstrGateway" then viz will not provide the correct data as both fields are same.

logs-

```auto
STAT : <....> mstrGateWay: ABC
STAT : <......> MstrGateWay ABC

```

current logstash conf filter-

```auto
filter{
 grok {
        break_on_match => false
        match => {
            "message" => [
             "mstrGateWay[:\s]*(?<mstrGateway>[A-Z0-9]+)",
             "MstrGateWay[\s](?<MstrGateWay>[A-Z0-9]+)",
              "STAT[:\s]*(?<STAT>[A-Z]+)"
                ]
            }
         }
}

```

Thank you !!

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 24, 2021, 7:00pm UTC](https://discuss.elastic.co/t/logs-contains-different-format-of-same-field-name-while-parsing-in-logstash/290103/2 "2021-11-24T19:00:16Z")

</div>

> [@Divyank\_Mahalle](#):
>
> ```auto
> "mstrGateWay[:\s]*(?<mstrGateway>[A-Z0-9]+)",
> "MstrGateWay[:\s]*(?<MstrGateway>[A-Z0-9]+)"
> 
> ```

If you want the field names to be the same, then just make them the same. Change \<MstrGateway\> to \<mstrGateway\>

```
         "mstrGateWay[:\s]*(?<mstrGateway>[A-Z0-9]+)",
         "MstrGateWay[:\s]*(?<mstrGateway>[A-Z0-9]+)"

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 22, 2021, 7:01pm UTC](https://discuss.elastic.co/t/logs-contains-different-format-of-same-field-name-while-parsing-in-logstash/290103/3 "2021-12-22T19:01:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.