# Repeating field name seems to silently fail **URL:** \ **Category:** Logstash\ **Created:** [December 14, 2017, 6:02pm UTC](https://discuss.elastic.co/t/repeating-field-name-seems-to-silently-fail/111832 "2017-12-14T18:02:30Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![ccullen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ccullen/32/25590_2.png) [@ccullen](https://discuss.elastic.co/u/ccullen)\ **Post date:** [December 14, 2017, 6:02pm UTC](https://discuss.elastic.co/t/repeating-field-name-seems-to-silently-fail/111832/1 "2017-12-14T18:02:30Z")
For the last 6 weeks or so I have been developing Logstash filters for the various logs our network produces, and I have been on a steep learning curve. It's possible that I am simply ignorant of some basic fact, but I've looked at various examples online and I've seen for myself that if a field name is repeated, Logstash ends up making that field into an array and stores all of the values captured to that fieldname in that array. I have logs produced by AMaViS which have some fields which may have one or sometimes more than one value, usually separated by commas, sometimes comma-space. So I'd like to use a regular expression (snippet) such as: ```auto (?:%{WORD:data}, )*%{WORD:data} ``` or its reverse: ```auto %{WORD:data}(?:, %{WORD:data})* ``` don't seem to work at all. These patterns work in the Grok debugger but they do not function at all inside Logstash. When I put these patterns into the logstash config, all the entries which ought to match instead get marked as \_grokparsefailure In the rare occasion that something like ```auto (?:%{WORD:data},)+ ``` will work, it seems to work as expected. That seems mysterious to me. Can anyone shed any light on why patterns using \* should fail when a similar pattern using + succeeds? It's clear to me that I can just capture the list portions and use `kv` or probably in my case Ruby to parse them into the lists that I want. But it seems like the grok parser should handle this, and that would certainly be simpler. I am new to the forum and I'm not presently certain how to attach files, so I will look into that, in order to provide a concrete example. (It looks like attachments aren't supported.) ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 15, 2017, 6:58am UTC](https://discuss.elastic.co/t/repeating-field-name-seems-to-silently-fail/111832/2 "2017-12-15T06:58:37Z")
Could you give an example of the kind of data you want to parse (one representative line is enough) as well as the full grok expression you're attempting to use? ---
**Author:** ![ccullen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ccullen/32/25590_2.png) [@ccullen](https://discuss.elastic.co/u/ccullen)\ **Post date:** [December 15, 2017, 4:18pm UTC](https://discuss.elastic.co/t/repeating-field-name-seems-to-silently-fail/111832/3 "2017-12-15T16:18:03Z")
In testing one last time the scenario I complained about, I found that today I was able to get that construct to function properly. So I must retract my complaint. I believe there may have been a trailing space at the end of the pattern which wasn't working properly. The patterns I've been working with are extremely hairy, so at a certain point I kinda go crosseyed and start missing details. Please accept my apologies for projecting my own errors onto `grok`. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 12, 2018, 4:18pm UTC](https://discuss.elastic.co/t/repeating-field-name-seems-to-silently-fail/111832/4 "2018-01-12T16:18:24Z")
Closed on January 12, 2018, 4:18pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.