# Variable length log

**URL:** <https://discuss.elastic.co/t/variable-length-log/224702>\
**Category:** Logstash\
**Created:** [March 23, 2020, 5:43pm UTC](https://discuss.elastic.co/t/variable-length-log/224702 "2020-03-23T17:43:17Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ElasticLiver](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticliver/32/64869_2.png) [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\
**Post date:** [March 23, 2020, 5:43pm UTC](https://discuss.elastic.co/t/variable-length-log/224702/1 "2020-03-23T17:43:18Z")

</div>

Grettings,

I have disk usage logs, these logs can have information of one or many disk, I am insterested in the "percent full"  
ex:

```auto
Disk/[C]/percent full=71.63, Disk/[C]/MB free=11591, Disk/[C]/MB total=40857, Disk/[E]/percent full=26.699, Disk/[E]/MB free=23493, Disk/[E]/MB total=52256

```

A simple grok will get me the fields that I want:

```auto
Disk/\[%{DATA:disk}\]/percent full=%{NUMBER:percent},.*Disk/\[%{DATA:disk2}\]/percent full=%{NUMBER:percent2}

```

but the quantity of disks is variable, in the next log example I got three disks:

```auto
Disk/[C]/percent full=71.63, Disk/[C]/MB free=11591, Disk/[C]/MB total=40857, Disk/[E]/percent full=26.699, Disk/[E]/MB free=23493, Disk/[E]/MB total=52256
Disk/[F]/percent full=46.49, Disk/[F]/MB free=93342, Disk/[F]/MB total=435256

```

and in some logs I have 12 disk.

The first thing thats comes to mind is using multiple groks, but here must be another way.

what will be the best way to handle this types of logs?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 23, 2020, 7:10pm UTC](https://discuss.elastic.co/t/variable-length-log/224702/2 "2020-03-23T19:10:25Z")

</div>

I would use ruby and a .scan function. See [here](https://discuss.elastic.co/t/grok-pattern-data-not-giving-all-matches-from-the-line/140468/2) for an example.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 20, 2020, 7:10pm UTC](https://discuss.elastic.co/t/variable-length-log/224702/3 "2020-04-20T19:10:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.