# Logstash - Grok dynamic parsing including nested fields
**URL:** https://discuss.elastic.co/t/logstash-grok-dynamic-parsing-including-nested-fields/287919
**Category:** Logstash
**Created:** [October 28, 2021, 1:18pm UTC](https://discuss.elastic.co/t/logstash-grok-dynamic-parsing-including-nested-fields/287919 "2021-10-28T13:18:43Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@anandd4](https://discuss.elastic.co/u/anandd4)
#### Post date: [October 28, 2021, 1:18pm UTC](https://discuss.elastic.co/t/logstash-grok-dynamic-parsing-including-nested-fields/287919/1 "2021-10-28T13:18:43Z")
Hello,
We have the following pattern which includes dynamic fields nested inside a tag(tag3 in the example below) that needs to be parsed & grok seems to be the go-to-filter to achieve this. However, given fields inside the specified tag are generated dynamically, I don't know if there is a way to handle this with grok along & looking for an efficient approach for this problem statement.
Can experts throw light on how this can be done using grok alone if possible or suitable alternatives?
Log pattern -
```auto
value1value2key.1=value1,key.2=value2,key.3=value3.....key.N=valueNvalue1
```
The other alternative I'm thinking of is to -
1. prase the message using grok as is
2. replace "." with "\_" using mutate filter
3. split each field as [key\_1=value key\_2=value2 key\_3=value3 ....] using mutate filter
4. Finally extract those fields using KV filter
I'm not sure if this is an efficient approach as we expect millions of such documents to be ingested in ES and hence need advice on how to approach this problem.
ELK Stack Version - 7.7
Thanks in advance
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [October 28, 2021, 5:33pm UTC](https://discuss.elastic.co/t/logstash-grok-dynamic-parsing-including-nested-fields/287919/2 "2021-10-28T17:33:42Z")
Why not use an xml filter and then a kv filter?
---
### Author:  [@anandd4](https://discuss.elastic.co/u/anandd4)
#### Post date: [October 30, 2021, 11:21am UTC](https://discuss.elastic.co/t/logstash-grok-dynamic-parsing-including-nested-fields/287919/3 "2021-10-30T11:21:11Z")
Thanks @Badger. Problem fixed
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 27, 2021, 11:21am UTC](https://discuss.elastic.co/t/logstash-grok-dynamic-parsing-including-nested-fields/287919/4 "2021-11-27T11:21:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.