# Multiple regex matches in a single line

**URL:** https://discuss.elastic.co/t/multiple-regex-matches-in-a-single-line/58126
**Category:** Logstash
**Created:** [August 16, 2016, 11:51am UTC](https://discuss.elastic.co/t/multiple-regex-matches-in-a-single-line/58126 "2016-08-16T11:51:00Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Ayush\_Rastogi](https://avatars.discourse-cdn.com/v4/letter/a/5daacb/32.png) [@Ayush\_Rastogi](https://discuss.elastic.co/u/Ayush_Rastogi)
#### Post date: [August 16, 2016, 11:51am UTC](https://discuss.elastic.co/t/multiple-regex-matches-in-a-single-line/58126/1 "2016-08-16T11:51:00Z")

</div>

Hi All,

I want to do multiple regex searches in a single line via logstash.

My log file  
`DEBUG - PerfLogging input_count:1 ,className:value,date:16-Aug-2016 07:13:40 ,TimeTaken:0.428 ,output_count:1`

I want to get the value CLASS=value  
and  
DATE=16-Aug-2016 07:13:40  
via the gork filter.

By fiddling around grok debugger, I found the following patterns.

finding class by a regex pattern search.  
`(?<CLASS>(?<=className:)\w{1,})`

> ```
> {
> "CLASS": [
> [
> "value"
> ]
> ]
> }
> 
> ```

Similarly for date,  
`(?<DATE>(?<=date:)[^,]{1,})`

> ```
> {
> "DATE": [
> [
> "16-Aug-2016 07:13:40 "
> ]
> ]
> }
> 
> ```

But I am not able to find both the fields at once.  
`(?<CLASS>(?<=className:)\w{1,}) (?<DATE>(?<=date:)[^,]{1,})`

> No Matches

Question 1.  
How should I get this working for more than one field, Once the filter starts working for two fields I would like to get all the values in similar fashion ( input\_count etc .. ).

Question 2.  
How do I ignore all the lines in the log file from processing which don't have `PerfLogging` keyword ?

Thanks,  
Ayush

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 16, 2016, 12:03pm UTC](https://discuss.elastic.co/t/multiple-regex-matches-in-a-single-line/58126/2 "2016-08-16T12:03:30Z")

</div>

> How should I get this working for more than one field, Once the filter starts working for two fields I would like to get all the values in similar fashion ( input\_count etc .. ).

I suggest you use the kv filter for this instead of grok.

> How do I ignore all the lines in the log file from processing which don't have PerfLogging keyword ?

The conditional filter

```plaintext
if [message] !~ /PerfLogging/ {
  drop { }
}

```

would do.

---

<div class="post-metadata">

### Author: ![Ayush\_Rastogi](https://avatars.discourse-cdn.com/v4/letter/a/5daacb/32.png) [@Ayush\_Rastogi](https://discuss.elastic.co/u/Ayush_Rastogi)
#### Post date: [August 17, 2016, 8:31am UTC](https://discuss.elastic.co/t/multiple-regex-matches-in-a-single-line/58126/3 "2016-08-17T08:31:50Z")

</div>

Thanks Magnus for the quick reply.  
I am able to get the data from the logs using the KV filter as desired.

But I see the type of the field, for example input\_size stored as "string" in logstash  
I want to store input\_size as "integer", TimeTaken as "double", date as datetype and so on,

Is there any to typecast these fields ?

Thanks,  
Ayush.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 17, 2016, 8:45am UTC](https://discuss.elastic.co/t/multiple-regex-matches-in-a-single-line/58126/4 "2016-08-17T08:45:44Z")

</div>

Use the mutate filter's convert option.

---

<div class="post-metadata">

### Author: ![Ayush\_Rastogi](https://avatars.discourse-cdn.com/v4/letter/a/5daacb/32.png) [@Ayush\_Rastogi](https://discuss.elastic.co/u/Ayush_Rastogi)
#### Post date: [August 17, 2016, 9:44am UTC](https://discuss.elastic.co/t/multiple-regex-matches-in-a-single-line/58126/5 "2016-08-17T09:44:09Z")

</div>

works just like I wanted it to, Thanks,

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:43am UTC](https://discuss.elastic.co/t/multiple-regex-matches-in-a-single-line/58126/6 "2017-07-06T04:43:05Z")

</div>