# Parse dynamic field names

**URL:** https://discuss.elastic.co/t/parse-dynamic-field-names/306558
**Category:** Logstash
**Created:** [June 7, 2022, 11:30am UTC](https://discuss.elastic.co/t/parse-dynamic-field-names/306558 "2022-06-07T11:30:56Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Soren\_vdc](https://avatars.discourse-cdn.com/v4/letter/s/b4bc9f/32.png) [@Soren\_vdc](https://discuss.elastic.co/u/Soren_vdc)
#### Post date: [June 7, 2022, 11:30am UTC](https://discuss.elastic.co/t/parse-dynamic-field-names/306558/1 "2022-06-07T11:30:56Z")

</div>

Hi,

I want to parse some code in message field where the field names contains a number. Example:  
responseGENERATED\_100=76 SENT\_100=76  
responseGENERATED\_180=221 SENT\_180=221  
responseGENERATED\_190=0 SENT\_183=0

The filename is different for other values (100,180,190,...)  
With grok match, I can't add matching in the fieldname. For example:  
grok { match =\> [ "responsegenerated\_%{NUMBER:number}", "%{NUMBER:responsegenerated\_%{NUMBER:number} SENT\_100=%{NUMBER:responsegenerated\_%{NUMBER:number}\_send}

Is there another possible solution to avoid grok match for all possible numbers.  
br  
Sören

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 7, 2022, 4:43pm UTC](https://discuss.elastic.co/t/parse-dynamic-field-names/306558/2 "2022-06-07T16:43:27Z")

</div>

If you want to extract the numbers then use

```
responseGENERATED_%{NUMBER:a}=%{NUMBER:b} SENT_%{NUMBER:c}=%{NUMBER:d}

```

If you want the field name to be responseGENERATED\_180 then use a kv filter, not grok.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2022, 4:43pm UTC](https://discuss.elastic.co/t/parse-dynamic-field-names/306558/3 "2022-07-05T16:43:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
