# Grok processor - Multiple matches of the same pattern

**URL:** <https://discuss.elastic.co/t/grok-processor-multiple-matches-of-the-same-pattern/317805>\
**Category:** Elasticsearch\
**Tags:** ingest-pipeline\
**Created:** [October 31, 2022, 9:54am UTC](https://discuss.elastic.co/t/grok-processor-multiple-matches-of-the-same-pattern/317805 "2022-10-31T09:54:12Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![robdiluca](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/robdiluca/32/98729_2.png) [@robdiluca](https://discuss.elastic.co/u/robdiluca)\
**Post date:** [October 31, 2022, 9:54am UTC](https://discuss.elastic.co/t/grok-processor-multiple-matches-of-the-same-pattern/317805/1 "2022-10-31T09:54:12Z")

</div>

Hi all,

I'm using the grok processor to parse the "message" field of a document in a ingest pipeline. That field can contain zero or more occurrences of UUIDs. I'm only interested in finding all the occurrences of UUIDs from that field and store them in another field, namely "event.uuid".  
For example, if I have a message field:

```auto
message : "[req-614ac1ab-7e21-4a6e-8083-f958700e5b65 d416c08b8ad45fa775af824a0396e7a36e123dd3f48a2735e8cbeb188d01f616 - 624ac1ab-7e21-4a6e-8083-f958700e5b65 179006ca05f24f658b108370ff5ad17f default] some other stuff"

```

I'd like to have something like:

```auto
event.uuid : ["614ac1ab-7e21-4a6e-8083-f958700e5b65", "624ac1ab-7e21-4a6e-8083-f958700e5b65"]

```

I tried this configuration:

```auto
{
  "pipeline": {
  "description" : "parse multiple patterns",
  "processors": [
    {
      "grok": {
        "ignore_failure": true,
        "field": "message",
        "patterns": ["%{UUID:event.uuid}"]
      }
    }
  ]
}

```

but this result only in the first UUID, i.e:

```auto
"event" : {
            "uuid" : "614ac1ab-7e21-4a6e-8083-f958700e5b65"
}

```

Anyone can help me?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 28, 2022, 9:54am UTC](https://discuss.elastic.co/t/grok-processor-multiple-matches-of-the-same-pattern/317805/2 "2022-11-28T09:54:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.