# Same pattern multiple times in a single logmessage

**URL:** <https://discuss.elastic.co/t/same-pattern-multiple-times-in-a-single-logmessage/60817>\
**Category:** Logstash\
**Created:** [September 18, 2016, 6:57pm UTC](https://discuss.elastic.co/t/same-pattern-multiple-times-in-a-single-logmessage/60817 "2016-09-18T18:57:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mayank\_Agrawal](https://avatars.discourse-cdn.com/v4/letter/m/3ab097/32.png) [@Mayank\_Agrawal](https://discuss.elastic.co/u/Mayank_Agrawal)\
**Post date:** [September 18, 2016, 6:57pm UTC](https://discuss.elastic.co/t/same-pattern-multiple-times-in-a-single-logmessage/60817/1 "2016-09-18T18:57:33Z")

</div>

One of the log messages is like this:

2016-07-20 09:01:39,708 28152772 INFO Received message key1=value1 key2=value2 key3=value3  
Msg 1: word1 rslt=0x00 try=1  
Msg 2: word2 rslt=0x01 try=4  
Msg 3: word2 rslt=0x02 try=8  
Msg 4: word1 rslt=0x03 try=9

Note:

- there can be any number of line of type  
Msg 'num': 'word' rslt='hexadecimal' try='num'

**I want single output with multiple json objects, like this:**

{

{  
"msg\_number":1,  
"msg\_name": word1  
"rslt":0x00  
"try":1  
}

{  
"msg\_number" : 2,  
"msg\_name": word2  
"rslt":0x01  
"try":4  
},

{  
"msg\_number" : 3,  
"msg\_name" : word2  
"rslt" : 0x02  
"try" : 8  
},

{  
"msg\_number" : 4,  
"msg\_name" : word1  
"rslt" : 0x03  
"try" : 9  
}  
}

Any help would be appreciated... 🙂

---

<div class="post-metadata">

**Author:** ![eperry](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eperry/32/551_2.png) [@eperry](https://discuss.elastic.co/u/eperry)\
**Post date:** [September 19, 2016, 12:35pm UTC](https://discuss.elastic.co/t/same-pattern-multiple-times-in-a-single-logmessage/60817/2 "2016-09-19T12:35:33Z")

</div>

IMO,

I think your going to have to use the ruby filter, as you have variable amounts of fields

[https://www.elastic.co/guide/en/logstash/current/plugins-filters-ruby.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-ruby.html)

---

<div class="post-metadata">

**Author:** ![Mayank\_Agrawal](https://avatars.discourse-cdn.com/v4/letter/m/3ab097/32.png) [@Mayank\_Agrawal](https://discuss.elastic.co/u/Mayank_Agrawal)\
**Post date:** [September 20, 2016, 6:11am UTC](https://discuss.elastic.co/t/same-pattern-multiple-times-in-a-single-logmessage/60817/3 "2016-09-20T06:11:49Z")

</div>

Well, I was trying not to use ruby filter, but it seems that is the only solution.  
Thanks 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:37am UTC](https://discuss.elastic.co/t/same-pattern-multiple-times-in-a-single-logmessage/60817/4 "2017-07-06T04:37:53Z")

</div>