Iterating over the same grok filter

Elastic Stack Logstash
3

grok only matches once, you will have to use String .scan in a ruby filter...

    ruby {
        code => '
            msg = event.get("message")
            if msg
                matches = msg.scan(/process_name="([^"]+)" cpu=([0-9\.]+(\s|$))/)
                matches.each { |x|
                    event.set("#{x[0]}_cpu", x[1].to_f)
                }
            end
        '
    }

to get

  "SNMP_cpu" => 8.37,
   "ARP_cpu" => 12.53