# Multiple matches in Grok filter **URL:** \ **Category:** Logstash\ **Created:** [May 24, 2019, 1:56pm UTC](https://discuss.elastic.co/t/multiple-matches-in-grok-filter/182667 "2019-05-24T13:56:15Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![f4fe5bb60e3686943680](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f4fe5bb60e3686943680/32/46801_2.png) [@f4fe5bb60e3686943680](https://discuss.elastic.co/u/f4fe5bb60e3686943680)\ **Post date:** [May 24, 2019, 1:56pm UTC](https://discuss.elastic.co/t/multiple-matches-in-grok-filter/182667/1 "2019-05-24T13:56:15Z")
Hello! I trying to parse search requests to one of my elastic database and i don`t know what to do when a two- or more-word search come. Config: input { beats { port =\> 5044 } } filter { if "_bulk" in [url][path] { drop { } } if "search" in [request] { grok { match =\> { '[http][request][body][content]' =\> '(?\(?\<=query\": \")\w{1,})'} } grok { match =\> { "[url][path]" =\> "/(?.\*)shared_._\d\_._\d/"} } mutate { update =\> { "query\_full" =\> "{%{query\_body}" } } } } output { if "search" in [request] and "ignore\_unmapped" not in [query\_body]{ elasticsearch { hosts =\> "rndtfsstgtools2:9200" } } } Request body: POST /workitemsearchshared\_0\_2/workItemContract/\_count?routing=f97e12fe-a1c6-41e6-b004-8bcec4a02473%2Cef42fcd5-a256-4df5-b832-ddc971a538ca&terminate\_after=51 HTTP/1.1\r\nAccept: application/json\r\nContent-Type: application/json\r\nAuthorization: Basic ZWxhc3RpY3VzZXI6TGFtYTNsZXI3\r\nHost: rndtfsstgsearch:9200\r\nContent-Length: 4169\r\nConnection: Keep-Alive\r\n\r\n{"query":{\r\n "bool": {\r\n "must": {\r\n "bool": {\r\n "must": [\r\n {\r\n "multi\_match": {\r\n "query": "credentials",\r\n "fields": [\r\n "fields.str","fields.str.stemmed","fields.html","fields.html.stemmed","fields.path","fields.str|title|system$","fields.str|title|system$.stemmed","fields.str|tags|system$","fields.str|tags|system$.stemmed","fields.path|areapath|system$","fields.path|areapath|system$.stemmed","fields.path|iterationpath|system$","fields.path|iterationpath|system$.stemmed","fields.str|state|system$","fields.str|state|system$.stemmed","fields.str|assignedto|system$","fields.str|assignedto|system$.stemmed","fields.str|createdby|system$","fields.str|createdby|system$.stemmed","fields.html|description|system$","fields.html|description|system$.stemmed","fields.html|history|system$","fields.html|history|system$.stemmed","fields.html|reprosteps|microsoft\>vsts\>tcm$","fields.html|reprosteps|microsoft\>vsts\>tcm$.stemmed","fields.html|steps|microsoft\>vsts\>tcm$","fields.html|steps|microsoft\>vsts\>tcm$.stemmed","fields.str|title|system$^10","fields.str|title|system$.stemmed^10","fields.html|description|system$^5","fields.html|description|system$.stemmed^5","fields.str|assignedto|system$^4"\r\n],\r\n "type": "phrase"\r\n }\r\n },\r\n {\r\n "multi\_match": {\r\n "query": "password",\r\n "fields": [\r\n "fields.str","fields.str.stemmed","fields.html","fields.html.stemmed","fields.path","fields.str|title|system$","fields.str|title|system$.stemmed","fields.str|tags|system$","fields.str|tags|system$.stemmed","fields.path|areapath|system$","fields.path|areapath|system$.stemmed","fields.path|iterationpath|system$","fields.path|iterationpath|system$.stemmed","fields.str|state|system$","fields.str|state|system$.stemmed","fields.str|assignedto|system$","fields.str|assignedto|system$.stemmed","fields.str|createdby|system$","fields.str|createdby|system$.stemmed","fields.html|description|system$","fields.html|description|system$.stemmed","fields.html|history|system$","fields.html|history|system$.stemmed","fields.html|reprosteps|microsoft\>vsts\>tcm$","fields.html|reprosteps|microsoft\>vsts\>tcm$.stemmed","fields.html|steps|microsoft\>vsts\>tcm$","fields.html|steps|microsoft\>vsts\>tcm$.stemmed","fields.str|title|system$^10","fields.str|title|system$.stemmed^10","fields.html|description|system$^5","fields.html|description|system$.stemmed^5","fields.str|assignedto|system$^4"\r\n],\r\n "type": "phrase"\r\n }\r\n..... Search query: ![2019-05-24_16-50-55](https://us1.discourse-cdn.com/elastic/original/3X/d/8/d8aa5fd421d2d7dcea6763442a89abe2816391b7.png) Matches: ![2019-05-24_16-52-13](https://us1.discourse-cdn.com/elastic/original/3X/8/4/84ffa0b7daaa63bd5fc01e8db125e03b125e6c55.png) How i can resolve it in regex or logstash or maybe i need use different scheme to resolve me Issue. And please sorry for my English. ---
**Author:** ![logger](https://avatars.discourse-cdn.com/v4/letter/l/34f0e0/32.png) [@logger](https://discuss.elastic.co/u/logger)\ **Post date:** [May 24, 2019, 2:57pm UTC](https://discuss.elastic.co/t/multiple-matches-in-grok-filter/182667/2 "2019-05-24T14:57:54Z")
So you are trying to parse the request body with logstash? as you can see it is json formatted query beginning from "{"query":{" with this you can grok it out and parse it as json. this qould be a bit much logic, but you can do it also like this: ``` if [field_with_query] =~ /credentials/ and [field_with_query] =~ /password/ { #use a filter as you want like mutate to add tags or fields } ``` ---
**Author:** ![logger](https://avatars.discourse-cdn.com/v4/letter/l/34f0e0/32.png) [@logger](https://discuss.elastic.co/u/logger)\ **Post date:** [May 24, 2019, 3:08pm UTC](https://discuss.elastic.co/t/multiple-matches-in-grok-filter/182667/3 "2019-05-24T15:08:08Z")
Ok maybe I did understand you wrong. So you can try to use a ruby filter to iterate on it. I really dont know how but I now it exists somewhere in this forum. Or you create many grokpatterns trying to get like 10 queries then 9 then 8 ... It is horrible and bad. but it works for some static amount 😉 ---
**Author:** ![f4fe5bb60e3686943680](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f4fe5bb60e3686943680/32/46801_2.png) [@f4fe5bb60e3686943680](https://discuss.elastic.co/u/f4fe5bb60e3686943680)\ **Post date:** [May 28, 2019, 7:08am UTC](https://discuss.elastic.co/t/multiple-matches-in-grok-filter/182667/4 "2019-05-28T07:08:34Z")
Hello, and thank you for very fast response! I think you understand me right, and i tried to do like in yous first answer. I changed my filter: > filter { > if "_bulk" in [url][path] { > drop { } > } > if "search" in [request] { > grok { > match =\> { "[url][path]" =\> "/(?.\*)shared_._\d\_._\d/"} > } > json { > source =\> "[http][request][body][content]" > target =\> "true\_json" > } > mutate { > add\_field =\> { "Query\_body" =\> "%{[true\_json][query][bool][must][bool][must]}" } > } > mutate { > add\_field =\> { "Repositories" =\> "%{[true\_json][query][bool][filter]}" } > } > } > } And it working, just like you said. its not perfect, but i can work with it: ![2019-05-28_10-06-57](https://us1.discourse-cdn.com/elastic/original/3X/2/a/2a5ade44c1c03402e3855172aa6d021f2bcb71a2.png) Thanks a lot for your help! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 25, 2019, 7:09am UTC](https://discuss.elastic.co/t/multiple-matches-in-grok-filter/182667/5 "2019-06-25T07:09:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.