# Question about creating Brobeat

**URL:** <https://discuss.elastic.co/t/question-about-creating-brobeat/70025>\
**Category:** Beats\
**Created:** [December 26, 2016, 11:52pm UTC](https://discuss.elastic.co/t/question-about-creating-brobeat/70025 "2016-12-26T23:52:31Z")\
**Posts on this page:** 1\
**Showing post:** 11

<div class="post-metadata">

**Author:** ![blacktop](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blacktop/32/14155_2.png) [@blacktop](https://discuss.elastic.co/u/blacktop)\
**Post date:** [January 4, 2017, 6:44pm UTC](https://discuss.elastic.co/t/question-about-creating-brobeat/70025/11 "2017-01-04T18:44:26Z")

</div>

So I will look into it again, but I still don't understand how it can work.

Let me give you an example:

fields: (ts:double, required), (ip:ip, required) (port:int, optional) (f1:int, optional)(f2:int, optional)(f3:int, optional)(f4:int, optional)

what if in one log there is f1 and f4 and then in another there is f2, f4.

How would logstash or a ingest node's grok pattern know to label the two int fields as (f1,f4) or (f2,f4) ?

---

_[View the full topic](https://discuss.elastic.co/t/question-about-creating-brobeat/70025)._