# Grok pattern DATA (.\*?) not giving all matches from the line

**URL:** <https://discuss.elastic.co/t/grok-pattern-data-not-giving-all-matches-from-the-line/140468>\
**Category:** Logstash\
**Created:** [July 18, 2018, 7:30am UTC](https://discuss.elastic.co/t/grok-pattern-data-not-giving-all-matches-from-the-line/140468 "2018-07-18T07:30:14Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 18, 2018, 3:04pm UTC](https://discuss.elastic.co/t/grok-pattern-data-not-giving-all-matches-from-the-line/140468/2 "2018-07-18T15:04:15Z")

</div>

> [@laxman1](#):
>
> Beginning Master Job Beginning child1 Job Beginning child2 Job

I would use a ruby filter to scan that.

```
    ruby {
        code => "
            s = event.get('message')
            r = s.scan(/Beginning ([^[:space:]]+) Job/)
            r = r.flatten
            event.set('jobs', r.join(','))
        "
    }

```

You might then want to mutate+split the jobs field.

---

_[View the full topic](https://discuss.elastic.co/t/grok-pattern-data-not-giving-all-matches-from-the-line/140468)._