# Finding a pattern multiple times in a multiline event

**URL:** <https://discuss.elastic.co/t/finding-a-pattern-multiple-times-in-a-multiline-event/87779>\
**Category:** Logstash\
**Created:** [May 31, 2017, 3:43pm UTC](https://discuss.elastic.co/t/finding-a-pattern-multiple-times-in-a-multiline-event/87779 "2017-05-31T15:43:54Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mahsa\_b](https://avatars.discourse-cdn.com/v4/letter/m/4af34b/32.png) [@mahsa\_b](https://discuss.elastic.co/u/mahsa_b)\
**Post date:** [May 31, 2017, 3:43pm UTC](https://discuss.elastic.co/t/finding-a-pattern-multiple-times-in-a-multiline-event/87779/1 "2017-05-31T15:43:54Z")

</div>

I am reading multiline from input and trying to match all the instances of the pattern. but it only output the first instance and not the rest. I'm not sure where I am making the mistake. this is my conf file content:

```
indent preformatted text by 4 spaces
input {
    file {
        path => "/usr/local/src/logstash/log1.in"
        start_position => beginning
        sincedb_path => "/dev/null"
        codec => multiline {
            pattern => "^show"
            negate => true
            what	=> next
        }
    }
}

filter {
    grok {

        patterns_dir => ["./patterns/mypatterns"]
        match	=> {"message" => ["(?m)configure vlan %{WORD:vlan} add ports %{PORTS:ports} %{TAG_INFO:tag_info}"]}
        break_on_match => false
    }
}

output {
    stdout {
        codec => rubydebug
    }
}

```

and this is the content of log1.in( I only have one 'show switch' command)

```
    configure snmp sysName "NY_MPBN_SS_1"
    configure snmp sysLocation "GSI New York"
    configure snmp sysContact "JPoserio@globecommsystems.com"
    configure timezone name New_Yor -240
    configure sys-recovery-level switch reset
    configure vlan CH_ACCESS add ports 19, 28, 46-47 tagged
    configure vlan CN_GN add ports 10, 46-47 tagged
    configure vlan CN_GN add ports 12 untagged
    configure vlan CN_Gn_GSN_1 add ports 3-8, 46 tagged
    configure vlan Default add ports 50 untagged
    show switch

```

and this is the output of running the conf file

 ![](https://us1.discourse-cdn.com/elastic/original/3X/c/a/ca0fce9b79f1699ceded2373664ad2889d10b2b8.PNG)

---

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [June 2, 2017, 8:23am UTC](https://discuss.elastic.co/t/finding-a-pattern-multiple-times-in-a-multiline-event/87779/2 "2017-06-02T08:23:21Z")

</div>

Please paste:

1. a long enough piece of your file to have at least two `show switch` lines.
2. the console output of the event that is captured.

use triple backticks above and below the pasted text - its easier to read, e.g.

```auto
[2017-06-01T15:58:38,222][INFO][o.e.n.Node] [eDuMM9L] stopped
[2017-06-01T15:58:38,222][INFO][o.e.n.Node] [eDuMM9L] closing ...
[2017-06-01T15:58:38,229][INFO][o.e.n.Node] [eDuMM9L] closed

```

---

<div class="post-metadata">

**Author:** ![mahsa\_b](https://avatars.discourse-cdn.com/v4/letter/m/4af34b/32.png) [@mahsa\_b](https://discuss.elastic.co/u/mahsa_b)\
**Post date:** [June 6, 2017, 2:56pm UTC](https://discuss.elastic.co/t/finding-a-pattern-multiple-times-in-a-multiline-event/87779/3 "2017-06-06T14:56:54Z")

</div>

I updated the original post . I hope it is more clear now

---

<div class="post-metadata">

**Author:** ![mahsa\_b](https://avatars.discourse-cdn.com/v4/letter/m/4af34b/32.png) [@mahsa\_b](https://discuss.elastic.co/u/mahsa_b)\
**Post date:** [June 13, 2017, 4:10pm UTC](https://discuss.elastic.co/t/finding-a-pattern-multiple-times-in-a-multiline-event/87779/4 "2017-06-13T16:10:17Z")

</div>

I believe my scenario could not be covered with the configs I had.  
I used ruby plugin and a for loop inside of it, to go through each line (of the multiline event) and extract the info I required.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 11, 2017, 4:10pm UTC](https://discuss.elastic.co/t/finding-a-pattern-multiple-times-in-a-multiline-event/87779/5 "2017-07-11T16:10:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.