Match multiple 4 digit numbers in field

Elastic Stack Logstash
2

grok will not match the same pattern repeatedly. I use the .scan function of a ruby string to do this You could try

    ruby {
        code => '
            created = event.get("created")
            if created
                matches = created.scan(/\d{4}/)
                # matches will be an array like ["2010"] or ["2000", "1994"]
                # Convert the array to integers
                matches = matches.map(&:to_i)
                event.set("mostRecentYear", matches.max)
            end
        '
    }

That assumes your field name is [created], not [created:]. You can overwrite [created] instead of adding a new field by changing the event.set line.

If you want to restrict the matches to strictly four digit numbers, and not match part of 123456 change the regexp to /\D\d{4}\D/