# Traiter des sous champs comme des logs à part entier à ingérer

**URL:** https://discuss.elastic.co/t/traiter-des-sous-champs-comme-des-logs-a-part-entier-a-ingerer/268771
**Category:** Logstash
**Created:** [March 30, 2021, 10:45am UTC](https://discuss.elastic.co/t/traiter-des-sous-champs-comme-des-logs-a-part-entier-a-ingerer/268771 "2021-03-30T10:45:58Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Yahya\_Bouzoubaa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yahya_bouzoubaa/32/85520_2.png) [@Yahya\_Bouzoubaa](https://discuss.elastic.co/u/Yahya_Bouzoubaa)
#### Post date: [March 30, 2021, 10:45am UTC](https://discuss.elastic.co/t/traiter-des-sous-champs-comme-des-logs-a-part-entier-a-ingerer/268771/1 "2021-03-30T10:45:58Z")

</div>

Bonjour,

Je souhaite parser un log et parser aussi un sous log (qui est un champ du log parent) et les ingérer dans deux logs différents.

Est ce que c'est possible et si oui quelle méthode ou script faudrait utiliser.

Je vous remercie par avance!

---

<div class="post-metadata">

### Author: ![Cad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cad/32/86661_2.png) [@Cad](https://discuss.elastic.co/u/Cad)
#### Post date: [April 8, 2021, 9:02pm UTC](https://discuss.elastic.co/t/traiter-des-sous-champs-comme-des-logs-a-part-entier-a-ingerer/268771/2 "2021-04-08T21:02:03Z")

</div>

Hi,

If you want to ask questions in French, please do it [here](https://discuss.elastic.co/c/in-your-native-tongue/discussions-en-francais/16).

What is the format of your data ?

Grok give a possibility to do that :  
If we take this log line  
`try number 123456 on 123456789`

With a grok pattern like this

```auto
filter {
    grok {
        match => {
            "message" => "(?<message>%{WORD} %{WORD} %{INT:num_try} %{WORD} (?<total_try>[0-9]+))"
        }
    }
}

```

The result is

```auto
"message": [
    [
      "try number 123456 on 123456789"
    ]
  ],
  "num_try": [
    [
      "123456"
    ]
  ],
  "total_try": [
    [
      "123456789"
    ]
  ]

```

So in grok you can create a custom patter with this syntax `(?<field_name> pattern here)`. This pattern can contain other custom patter or existing pattern (num\_try and total\_try in the example).

Another solution would be to copy the global pattern in another field with the [mutate](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-copy) filter and edit the copy filed in ruby.

Cad.

---

<div class="post-metadata">

### Author: ![Yahya\_Bouzoubaa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yahya_bouzoubaa/32/85520_2.png) [@Yahya\_Bouzoubaa](https://discuss.elastic.co/u/Yahya_Bouzoubaa)
#### Post date: [April 9, 2021, 7:17am UTC](https://discuss.elastic.co/t/traiter-des-sous-champs-comme-des-logs-a-part-entier-a-ingerer/268771/3 "2021-04-09T07:17:29Z")

</div>

thank you so much for your response.

My problem was to use two patterns (in the bloc input {file} ) for the same logs.  
it was like parsing the same file in two diffrents ways.

finally I had no solution and suddenly I used two .conf

thank you again

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 7, 2021, 7:17am UTC](https://discuss.elastic.co/t/traiter-des-sous-champs-comme-des-logs-a-part-entier-a-ingerer/268771/4 "2021-05-07T07:17:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.