# Event with multiple patterns

**URL:** <https://discuss.elastic.co/t/event-with-multiple-patterns/250700>\
**Category:** Logstash\
**Created:** [October 1, 2020, 2:45pm UTC](https://discuss.elastic.co/t/event-with-multiple-patterns/250700 "2020-10-01T14:45:41Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![fluss](https://avatars.discourse-cdn.com/v4/letter/f/a9adbd/32.png) [@fluss](https://discuss.elastic.co/u/fluss)\
**Post date:** [October 1, 2020, 2:45pm UTC](https://discuss.elastic.co/t/event-with-multiple-patterns/250700/1 "2020-10-01T14:45:41Z")

</div>

Hello,

I have an event as on below:  
Rule 'device' failed for user 'user45' reason 'Rule1:OS not found'.

grok {  
match =\> ["event","%{GREEDYDATA}reason '%{GREEDYDATA:rule}:%{GREEDYDATA:reason}'."]  
}

rule: Rule1  
reason: OS not found

But now I have the same event with multiple occurences after reason separated by a ";" :  
Rule 'device' failed for user 'user45' reason 'Rule1:OS not found;Rule5:certificate not found'.

So I have an event as on below:  
....... reason 'Rule1:reason1;Rule2:reason2;...;RuleX:reasonX'.

I want to put these values into 2 fields : rule and reason (each value separete by a ",")  
rule: Rule1, Rule5, ...  
reason: OS not found, certificate not found, reason

Do you know how I can achieve this ? Using regex I suppose

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 1, 2020, 3:44pm UTC](https://discuss.elastic.co/t/event-with-multiple-patterns/250700/2 "2020-10-01T15:44:28Z")

</div>

> [@fluss](#):
>
> Do you know how I can achieve this ?

When I run

```
input { generator { count => 1 lines => [''] } }
filter {
    mutate { add_field => { "reasons" => "reason 'Rule1:reason1;Rule2:reason2;Rule5:reason5'." } }
    ruby {
        code => '
            matches = event.get("reasons").scan(/(Rule\d+):([^;]+)[;\']/)
            rule = ""
            reason = ""
            matches.each_index { |x|
                rule += matches[x][0] + ","
                reason += matches[x][1] + ","
            }
            event.set("rule", rule.delete_suffix(","))
            event.set("reason", reason.delete_suffix(","))
        '
    }
}
output { stdout { codec => rubydebug { metadata => false } } }

```

I get

```
    "reason" => "reason1,reason2,reason5",
   "reasons" => "reason 'Rule1:reason1;Rule2:reason2;Rule5:reason5'.",
      "rule" => "Rule1,Rule2,Rule5"

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 29, 2020, 3:44pm UTC](https://discuss.elastic.co/t/event-with-multiple-patterns/250700/3 "2020-10-29T15:44:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.