# SOLVED: Grok + Dynamic field name

**URL:** https://discuss.elastic.co/t/solved-grok-dynamic-field-name/52842
**Category:** Logstash
**Created:** [June 15, 2016, 9:02am UTC](https://discuss.elastic.co/t/solved-grok-dynamic-field-name/52842 "2016-06-15T09:02:10Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Clement\_Ros](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/clement_ros/32/6198_2.png) [@Clement\_Ros](https://discuss.elastic.co/u/Clement_Ros)
#### Post date: [June 15, 2016, 9:02am UTC](https://discuss.elastic.co/t/solved-grok-dynamic-field-name/52842/1 "2016-06-15T09:02:10Z")

</div>

Hi everybody,

I am creating filters for monitoring a new server.

I have a amavis log that perform spamassassin tests on email.  
The problem is that there are a hundred tests and the tests in the log are never the same .

For example i can have this :

`test1=1, test2=2, test3=3`  
`test2=4, test5=0.1, test10=0.001, test50=2, test48=0.0001`

I would like to retrieve the field values. But how could I identify the field values ?

I wondered if it was possible to recover the first part of the test ( name), then retrieve the second part of the test ( value ) and finally to the test name previously recovered as a field name (value) ?

it will give something:

`log : test1=0,01 grok: %{DATA:test_name}=%{DATA:$test_name}`

I don't know how to do that or even if we can do that.

Thanks and Regards,  
Clément ROS

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [June 15, 2016, 9:05am UTC](https://discuss.elastic.co/t/solved-grok-dynamic-field-name/52842/2 "2016-06-15T09:05:10Z")

</div>

Use grok to separate out the key-value list into a single field (if necessary) and then use the [kv filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html) to parse it.

---

<div class="post-metadata">

### Author: ![Clement\_Ros](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/clement_ros/32/6198_2.png) [@Clement\_Ros](https://discuss.elastic.co/u/Clement_Ros)
#### Post date: [June 17, 2016, 7:43am UTC](https://discuss.elastic.co/t/solved-grok-dynamic-field-name/52842/3 "2016-06-17T07:43:07Z")

</div>

Thanks,

It works.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:52am UTC](https://discuss.elastic.co/t/solved-grok-dynamic-field-name/52842/4 "2017-07-06T04:52:18Z")

</div>