# I want to match one pattern multiple times in a logevent

**URL:** <https://discuss.elastic.co/t/i-want-to-match-one-pattern-multiple-times-in-a-logevent/186860>\
**Category:** Logstash\
**Created:** [June 21, 2019, 10:08am UTC](https://discuss.elastic.co/t/i-want-to-match-one-pattern-multiple-times-in-a-logevent/186860 "2019-06-21T10:08:27Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sonukumarsah](https://avatars.discourse-cdn.com/v4/letter/s/3e96dc/32.png) [@sonukumarsah](https://discuss.elastic.co/u/sonukumarsah)\
**Post date:** [June 21, 2019, 10:08am UTC](https://discuss.elastic.co/t/i-want-to-match-one-pattern-multiple-times-in-a-logevent/186860/1 "2019-06-21T10:08:27Z")

</div>

This is my sample log..  
Jan 16, 2019 2:12:00 PM com.InfoProviderImpl calculateTotalExposureTime  
SEVERE: AOMFrameworkException occured while Executing srl: Group children ClusterNode size is 0 and index is 0  
com.aomframework.data.revodata.ifc.AOMFrameworkException: Group children ClusterNode size is 0 and index is 0  
at com.verifyTrue(RequestExtUtils.java:396)  
at com.getRxDataChildValue(RequestExtUtils.java:500)  
at com.getRxDataChildDoubleValue(RequestExtUtils.java:522)  
at com.execute(HelicalOffsetUtil.java:103)  
at com.calculateTotalExposureTime(InfoProviderImpl.java:166)  
at java.awt.EventDispatchThread.pumpOneEventForFilters(Unknown Source)  
at java.awt.EventDispatchThread.pumpEventsForFilter(Unknown Source)  
at java.awt.EventDispatchThread.pumpEventsForHierarchy(Unknown Source)  
at java.awt.EventDispatchThread.pumpEvents(Unknown Source)  
at java.awt.EventDispatchThread.pumpEvents(Unknown Source)  
at java.awt.EventDispatchThread.run(Unknown Source)  
Jan 16, 2019 2:12:00 PM open.comm.IpcChannel connect

i want to grep all java file names like that "RequestExtUtils.java:396", "RequestExtUtils.java:522" ....  
but my grok filter grepping only first match after that its stopped.

grok-pattern:  
EXCEPTIONDETAILS (\w\*.java:\d\*)

configuration:  
grok {  
patterns\_dir =\> "../data/patterns"  
match =\> { "data" =\> "%{EXCEPTIONDETAILS:Exception\_Details}"}  
}

I hope somebody can help me.

Thanks.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 21, 2019, 1:14pm UTC](https://discuss.elastic.co/t/i-want-to-match-one-pattern-multiple-times-in-a-logevent/186860/2 "2019-06-21T13:14:00Z")

</div>

```
ruby { code => 'event.set("matches", event.get("message").scan( /\((\w+\.\w+:\d+)\)/ ).flatten)' }

```

will get you

```
   "matches" => [
    [0] "RequestExtUtils.java:396",
    [1] "RequestExtUtils.java:500",
    [2] "RequestExtUtils.java:522",
    [3] "HelicalOffsetUtil.java:103",
    [4] "InfoProviderImpl.java:166"
]
```

---

<div class="post-metadata">

**Author:** ![sonukumarsah](https://avatars.discourse-cdn.com/v4/letter/s/3e96dc/32.png) [@sonukumarsah](https://discuss.elastic.co/u/sonukumarsah)\
**Post date:** [June 24, 2019, 12:45pm UTC](https://discuss.elastic.co/t/i-want-to-match-one-pattern-multiple-times-in-a-logevent/186860/3 "2019-06-24T12:45:11Z")

</div>

Thanks, @Badger for your reply.. now its working as what i am exactly expecting.

I tried one more option that too working....  
ruby {  
code =\> "  
saveid = event.get('data').scan(/\w+.java:\d+/)  
event.set('Exception\_Details',saveid)  
"  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 22, 2019, 12:45pm UTC](https://discuss.elastic.co/t/i-want-to-match-one-pattern-multiple-times-in-a-logevent/186860/4 "2019-07-22T12:45:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.