grok filter: How to match one pattern multiple times?

[jordansissel]

(This issue was originally filed by @stbka at https://github.com/elastic/logstash/issues/2006)

---

I want to match one pattern multiple times in a logevent. Tried different regex pattern but I don't get it working.

Example-event: This is a statusCode="ERROR_121" text to demonstrate my logevent statusCode="WARNING_2408" structure

What I want to have is a statusCode field with "ERROR_121" as well as "WARNING_2408". Notice that it is possible that the event does not contain any statusCode.

My problem is that grok filter finds either just one entry and breaks or if I combine one pattern with a * it does not find anything.

Example-pattern: STATUSCODE [a-zA-Z0-9_-]+ STATUSCODEENTRY statusCode=.%{STATUSCODE:statusCode}. STATUSCODES (%{STATUSCODEENTRY}.+)*

I hope somebody can help me.

Thanks.

[tom-christie]

I have the same question. Why was this closed?

[ph]

@tom-christie the issue is not closed, it was moved from the main logstash repository to the plugin specific repository.

[DustinChaloupka]

:+1: Have also noticed this. A workaround could be to use the split filter and find some sort of delimiter (in this case statusCode= could maybe be used) and send it through the grok filter as separate events...

[jordansissel]

Maybe related to #34 or #35.

[naisanza]

+1 this is more or less what I was looking for with #50 as well!

[Solisol]

+1

[gilles-m]

+1

[ghost]

+1

[thenom]

+1

[maniankara]

+1

[okazymyrov]

+1

[Name-less]

+1

[sergunSpb]

Hi devs, really needs this feature.

[thadumi]

Hi, I'm also looking for this feature. Did someone find a solution?

[torbajanos]

I'm also looking for this feature.

[epacke]

Me too! And thanks for making logstash, it's great!

[thommiller]

Also came here to say this would be a great feature. Either recursive definitions or ideally something like the regex [aZ]{1,3} which will match anything between 1 and 3 alphabetic characters. If we could do this with grok tags like %{NOTSPACE:variable}{1,3}

[Erni]

It would definitely be a great feature, asked by many users already.

[galiacheng]

I'm also looking for this feature.

[Littlericket]

Same. Would also perfectly fit for grokking mod_security logs and their tags.

[ifleg]

+1

[ifleg]

For those who are interested, I succeeded using the scan function in ruby ! I can extract the tags from modsecurity alerts using the following filter in logstash :

ruby {
	code => "event.set('modsec.tags', event.get('message').scan(/(?<=\[tag \")[^\]]*(?=\"\])/))"
}

This identify ALL the tags in message and put them in the modsec.tags field.