# Logstash filter for varying number of disks info in the logs

**URL:** <https://discuss.elastic.co/t/logstash-filter-for-varying-number-of-disks-info-in-the-logs/281400>\
**Category:** Logstash\
**Created:** [August 13, 2021, 7:21pm UTC](https://discuss.elastic.co/t/logstash-filter-for-varying-number-of-disks-info-in-the-logs/281400 "2021-08-13T19:21:41Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 13, 2021, 7:46pm UTC](https://discuss.elastic.co/t/logstash-filter-for-varying-number-of-disks-info-in-the-logs/281400/2 "2021-08-13T19:46:18Z")

</div>

I would not use grok for that. I would use dissect and kv.

```
    dissect { mapping => { "message" => "%{[@metadata][ts]}|%{}| disk-usage: %{[@metadata][restOfLine]}" } }
    date { match => ["[@metadata][ts]", UNIX ] }
    kv { trim_value => "%" }

```

will produce

```
"@timestamp" => 2021-08-13T15:21:22.953Z,
         "1" => "46",
         "2" => "44",
         "3" => "52",

```

etc. I would then be tempted to either

```
    ruby {
        code => '
            diskUsage = []
            event.to_hash.each { |k, v|
                if k =~ /^\d+$/
                    diskUsage[k.to_i] = v.to_i;
                end
                event.remove(k)
            }
            diskUsage.shift
            event.set("diskUsage", diskUsage)
        '
    }

```

to get

```
 "diskUsage" => [
    [0] 46,
    [1] 44,
    [2] 52,
    [3] 52,
    [4] 46,
    [5] 40,
    [6] 45,
    [7] 48
]

```

or

```
    ruby {
        code => '
            diskUsage = []
            event.to_hash.each { |k, v|
                if k =~ /^\d+$/
                    event.set("diskUsage#{k.to_i}", v.to_i)
                end
                event.remove(k)
            }
        '
    }

```

to get

```
 "diskUsage5" => 46,
 "diskUsage4" => 52,
 "diskUsage7" => 45,

```

etc.

---

_[View the full topic](https://discuss.elastic.co/t/logstash-filter-for-varying-number-of-disks-info-in-the-logs/281400)._