# Iterating over the same grok filter

**URL:** https://discuss.elastic.co/t/iterating-over-the-same-grok-filter/295089
**Category:** Logstash
**Created:** [January 21, 2022, 5:29pm UTC](https://discuss.elastic.co/t/iterating-over-the-same-grok-filter/295089 "2022-01-21T17:29:05Z")
**Posts on this page:** 1
**Showing post:** 3

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 21, 2022, 8:05pm UTC](https://discuss.elastic.co/t/iterating-over-the-same-grok-filter/295089/3 "2022-01-21T20:05:52Z")

</div>

grok only matches once, you will have to use String .scan in a ruby filter...

```
    ruby {
        code => '
            msg = event.get("message")
            if msg
                matches = msg.scan(/process_name="([^"]+)" cpu=([0-9\.]+(\s|$))/)
                matches.each { |x|
                    event.set("#{x[0]}_cpu", x[1].to_f)
                }
            end
        '
    }

```

to get

```
  "SNMP_cpu" => 8.37,
   "ARP_cpu" => 12.53
```

---

_[View the full topic](https://discuss.elastic.co/t/iterating-over-the-same-grok-filter/295089)._