# How to match all pattern found in message

**URL:** <https://discuss.elastic.co/t/how-to-match-all-pattern-found-in-message/123200>\
**Category:** Logstash\
**Created:** [March 9, 2018, 6:09am UTC](https://discuss.elastic.co/t/how-to-match-all-pattern-found-in-message/123200 "2018-03-09T06:09:59Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Eaky\_Ake](https://avatars.discourse-cdn.com/v4/letter/e/a4c791/32.png) [@Eaky\_Ake](https://discuss.elastic.co/u/Eaky_Ake)\
**Post date:** [March 9, 2018, 6:09am UTC](https://discuss.elastic.co/t/how-to-match-all-pattern-found-in-message/123200/1 "2018-03-09T06:09:59Z")

</div>

I have a log file that record multi-event log (multiline log). How to config logstash to match same pattern into one. I try to grok with option break\_on\_match =\> false but not working

18:16:16.075 Customer selected choice : C  
18:16:17.406 \>\>---------------------------------\>\>  
18:16:17.406 Customer In ---\>  
18:16:21.207 Customer selected choice : C  
18:16:25.904 Customer selected choice : C  
18:16:28.778 Customer selected choice : B  
18:16:36.665 Customer selected choice : REMOVE  
18:16:42.600 Shutter Opening  
18:22:49.067 Customer Out \<---  
18:22:49.067 \<\<---------------------------------\<\<

my grok config  
grok {

```
    patterns_dir => "C:\Program Files\ELK\LogStash\pattern"
    match => { "message" => ["(?m)%{TIME} Customer selected choice : %{WORD:choice}%{SPACE}"] }
}

```

output I got  
{  
"TIME": [  
[  
"18:16:16.075"  
]  
],  
"HOUR": [  
[  
"18"  
]  
],  
"MINUTE": [  
[  
"16"  
]  
],  
"SECOND": [  
[  
"16.075"  
]  
],  
"choice": [  
[  
"C"  
]  
]  
}

output I want  
{  
choice : ['C','C','C','B','REMOVE']  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 6, 2018, 6:10am UTC](https://discuss.elastic.co/t/how-to-match-all-pattern-found-in-message/123200/2 "2018-04-06T06:10:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.