# Logstash sendmail grok procesing multiple field value **URL:** \ **Category:** Logstash\ **Created:** [May 24, 2016, 3:09pm UTC](https://discuss.elastic.co/t/logstash-sendmail-grok-procesing-multiple-field-value/50859 "2016-05-24T15:09:38Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Emilio\_Ampudia\_Marti](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emilio_ampudia_marti/32/9919_2.png) [@Emilio\_Ampudia\_Marti](https://discuss.elastic.co/u/Emilio_Ampudia_Marti)\ **Post date:** [May 24, 2016, 3:09pm UTC](https://discuss.elastic.co/t/logstash-sendmail-grok-procesing-multiple-field-value/50859/1 "2016-05-24T15:09:38Z")
I have this sendmail log line: May 24 16:17:28 mailserver sendmail[11337]: u4OEHO27011330: to=[XXX@ific.uv.es](mailto:XXX@ific.uv.es),[YYY@ific.uv.es](mailto:YYY@ific.uv.es),[AAA@ific.uv.es](mailto:AAA@ific.uv.es),[POPP.AD@ific.uv.es](mailto:POPP.AD@ific.uv.es), delay=00:00:04, xdelay=00:00:03, mailer=esmtp, pri=238177, [relay=ifmx.ific.uv.es](http://relay=ifmx.ific.uv.es)., dsn=2.0.0, stat=Sent (Ok: queued as 1C201A03AB) I don't know who to process the "to" multiple field. Something like that: TOFIELD to=(\<%{EMAIL:to}\>,)+ I only get the last value, I would like to get them all. Thanks 😉 Emilio ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 24, 2016, 3:13pm UTC](https://discuss.elastic.co/t/logstash-sendmail-grok-procesing-multiple-field-value/50859/2 "2016-05-24T15:13:26Z")
I suggest you capture them all into a single field and use the mutate filter's split option to split that field into an array. I also think you should consider using a kv filter instead of grok for the key/value pairs in the log message. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:56am UTC](https://discuss.elastic.co/t/logstash-sendmail-grok-procesing-multiple-field-value/50859/3 "2017-07-06T04:56:27Z")
Closed on July 6, 2017, 4:56am UTC