Grok pattern DATA (.*?) not giving all matches from the line

[laxman1 (Laxman)]

Text : Beginning Master Job Beginning child1 Job Beginning child2 Job

when I used the below grok pattern temp variable is capturing only "Master" where as I need "child1" and "child2" matches also from text
grok{

           patterns_dir => ["./patterns"]
           match => {"message" => "Beginning %{DATA:temp} Job"}
          break_on_match => false
    }

I made break_on_match false also

[Badger]

@laxman1

Beginning Master Job Beginning child1 Job Beginning child2 Job

I would use a ruby filter to scan that.

    ruby {
        code => "
            s = event.get('message')
            r = s.scan(/Beginning ([^[:space:]]+) Job/)
            r = r.flatten
            event.set('jobs', r.join(','))
        "
    }

You might then want to mutate+split the jobs field.

[laxman1 (Laxman)]

Thanks for the reply. It is working for this but I have multiple patterns in such way. It would be nicer if it is taken care by grok filter.