# How to capture regex groups with /g?
**URL:** https://discuss.elastic.co/t/how-to-capture-regex-groups-with-g/55858
**Category:** Logstash
**Created:** [July 19, 2016, 10:35am UTC](https://discuss.elastic.co/t/how-to-capture-regex-groups-with-g/55858 "2016-07-19T10:35:55Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@asp](https://discuss.elastic.co/u/asp)
#### Post date: [July 19, 2016, 10:35am UTC](https://discuss.elastic.co/t/how-to-capture-regex-groups-with-g/55858/1 "2016-07-19T10:35:55Z")
Hi,
I have following excerpt of a log line:
... [NO SORT], #0...#4000 (PageSize: 4001), , Fetched: 13, 687 ms0...END (PageSize: INFINITE), , Fetched: 147, 15 ms0...END (PageSize: INFINITE), , Fetched: 147, 16 ms0...END (PageSize: INFINITE), , Fetched: 147, 16 ms0...END (PageSize: INFINITE), , Fetched: 147, 15 ms0...END (PageSize: INFINITE), , Fetched: 147, 31 ms0...END (PageSize: INFINITE), , Fetched: 147, 47 ms0...END (PageSize: INFINITE), , Fetched: 147, 16 ms0...END (PageSize: INFINITE), , Fetched: 147, 15 ms0...END (PageSize: INFINITE), , Fetched: 147, 0 ms0...END (PageSize: INFINITE), , Fetched: 147, 32 ms0...END (PageSize: INFINITE), , Fetched: 147, 46 ms0...END (PageSize: INFINITE), , Fetched: 147, 16 ms0...END (PageSize: INFINITE), , Fetched: 147, 16 ms
I need to extract all given ms and aggregate them together and save them as field.
In regex I can get the values as following:
```auto
```
This gives me 14 regex groups back.
But how do I do it in logstash? And how do I aggregate them together? (value1+value2+value3...)
Thanks, Andreas
---
### Author:  [@PhaedrusTheGreek](https://discuss.elastic.co/u/PhaedrusTheGreek)
#### Post date: [July 19, 2016, 4:31pm UTC](https://discuss.elastic.co/t/how-to-capture-regex-groups-with-g/55858/2 "2016-07-19T16:31:17Z")
OK @asp,
Would you share the ruby filter here when you have it working?
---
### Author:  [@asp](https://discuss.elastic.co/u/asp)
#### Post date: [July 20, 2016, 11:08am UTC](https://discuss.elastic.co/t/how-to-capture-regex-groups-with-g/55858/3 "2016-07-20T11:08:05Z")
I am currently heading for workaround it with the ruby filter.
I have written a ruby script which does the regex search and aggregates the data., but its not finished yet
---
### Author:  [@aya](https://discuss.elastic.co/u/aya)
#### Post date: [September 8, 2016, 10:46am UTC](https://discuss.elastic.co/t/how-to-capture-regex-groups-with-g/55858/4 "2016-09-08T10:46:53Z")
I had a similar need and had to use the ruby filter too.
This example capture each block of alpha characters from the field 'input' and add them to a new field 'groups'.
```
filter {
ruby {
code => "event['groups'] = event['input'].downcase.scan(/[[:alpha:]]+/)"
}
}
```
input = "Module1-Customer-Region\_2-FuncX-Label42"
groups = ["module", "customer", "region", "funcx", "label"]
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:39am UTC](https://discuss.elastic.co/t/how-to-capture-regex-groups-with-g/55858/5 "2017-07-06T04:39:17Z")