# Split a string to array/list, greedy match
**URL:** https://discuss.elastic.co/t/split-a-string-to-array-list-greedy-match/255305
**Category:** Logstash
**Created:** [November 13, 2020, 8:40am UTC](https://discuss.elastic.co/t/split-a-string-to-array-list-greedy-match/255305 "2020-11-13T08:40:57Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@blukit](https://discuss.elastic.co/u/blukit)
#### Post date: [November 13, 2020, 8:40am UTC](https://discuss.elastic.co/t/split-a-string-to-array-list-greedy-match/255305/1 "2020-11-13T08:40:57Z")
Hi all...
I have a **message** field that contains multiline string. Need to split it to an array for each line, because will do some logic based on a certain lines. But so far only able to catch the first line.
A simplified log sample
```auto
JSONRestClient : GET Response details:
--------------------------------------------
Response method: GET
ETag [W/"8e-hDyRewehT0hTestTUAILD4GrqfI"]
Access-Control-Allow-Origin [*]
Content-Length [142]
Date [Wed, 11 Nov 2020 11:00:13 GMT]
Cache-control [private]
X-Powered-By [Express]
Content-Type [application/json; charset=utf-8]
Response content: {"data":[{"bankCode":"494",{"bankCode":"002","bankName":"BANK XYZ"}],"responseCode":"00","responseDesc":"Success"}
```
I've tried this config, but only get the first line of log
> grok {
> match =\> ["message", "(?[^\r\n]\*)" ]
> remove\_field =\> ["message"]
> break\_on\_match =\> false
> }
Need it to be
"msg": ["Access-Control-Allow-Origin [\*]", " Content-Length [142]", ... ]
Already tried [Split filter plugin | Logstash Reference [7.16] | Elastic](https://www.elastic.co/guide/en/logstash/7.x/plugins-filters-split.html) but don't want to split it as individual event
---
### Author:  [@wangqinghuan](https://discuss.elastic.co/u/wangqinghuan)
#### Post date: [November 14, 2020, 6:06pm UTC](https://discuss.elastic.co/t/split-a-string-to-array-list-greedy-match/255305/2 "2020-11-14T18:06:32Z")
Hi
I believe you should seek [mutline](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-multiline.html) support rather than split support as your log sample spans multiple lines.
---
### Author:  [@blukit](https://discuss.elastic.co/u/blukit)
#### Post date: [December 2, 2020, 10:58am UTC](https://discuss.elastic.co/t/split-a-string-to-array-list-greedy-match/255305/3 "2020-12-02T10:58:11Z")
ok...found it, ruby code
> ruby {
> code =\> "
> message = event.get("message")
> msg = message.split("\n")
> event.set("msg", msg)
> "
> }
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 30, 2020, 10:58am UTC](https://discuss.elastic.co/t/split-a-string-to-array-list-greedy-match/255305/4 "2020-12-30T10:58:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.