# Syslog - logs contain dynamic fields(parameters) based on event type, how to index?

**URL:** https://discuss.elastic.co/t/syslog-logs-contain-dynamic-fields-parameters-based-on-event-type-how-to-index/236144
**Category:** Logstash
**Created:** [June 8, 2020, 9:18am UTC](https://discuss.elastic.co/t/syslog-logs-contain-dynamic-fields-parameters-based-on-event-type-how-to-index/236144 "2020-06-08T09:18:48Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 8, 2020, 2:12pm UTC](https://discuss.elastic.co/t/syslog-logs-contain-dynamic-fields-parameters-based-on-event-type-how-to-index/236144/2 "2020-06-08T14:12:18Z")

</div>

I would use dissect to parse off the start of the message, then a kv filter. Something like [this](https://discuss.elastic.co/t/reading-data-from-kafka-and-use-filter-json-fails-with-parsererror/132179/2).

---

_[View the full topic](https://discuss.elastic.co/t/syslog-logs-contain-dynamic-fields-parameters-based-on-event-type-how-to-index/236144)._