So I will look into it again, but I still don't understand how it can work.
Let me give you an example:
fields: (ts:double, required), (ip:ip, required) (port:int, optional) (f1:int, optional)(f2:int, optional)(f3:int, optional)(f4:int, optional)
what if in one log there is f1 and f4 and then in another there is f2, f4.
How would logstash or a ingest node's grok pattern know to label the two int fields as (f1,f4) or (f2,f4) ?