# Using RegEx for multiple matches to store in single field or dynamic fields

**URL:** <https://discuss.elastic.co/t/using-regex-for-multiple-matches-to-store-in-single-field-or-dynamic-fields/151742>\
**Category:** Logstash\
**Created:** [October 10, 2018, 3:50am UTC](https://discuss.elastic.co/t/using-regex-for-multiple-matches-to-store-in-single-field-or-dynamic-fields/151742 "2018-10-10T03:50:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![nicpenning](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nicpenning/32/36366_2.png) [@nicpenning](https://discuss.elastic.co/u/nicpenning)\
**Post date:** [October 10, 2018, 3:50am UTC](https://discuss.elastic.co/t/using-regex-for-multiple-matches-to-store-in-single-field-or-dynamic-fields/151742/1 "2018-10-10T03:50:45Z")

</div>

Is it possible to parse an event field for multiple values and have all matches be stored in multiple new fields dynamically?

For example, if [message] contains multiple hits on a regex searching for URLs, could they all get stored in new fields called URLs.N respectively?

I understand that using the grok filter that you can store the first value in a newly created field.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/b/8b19d645d7785bded271ffa551b3d7d23fb42264.png)

But I wish to store all matches. Secondarily, I wish to store the different capture groups into fields as well.

![image](https://us1.discourse-cdn.com/elastic/original/3X/d/0/d0d7c1f72d0a3ba273f92092ce2e5bd35f64834d.png)

So in the examples below I would like Match 1.1 and Match 2.1 to be stored in a dynamic variable:

URL.1 =\> [https://windscribe.com/../gif](https://windscribe.com/../gif)  
URL.2 =\> [https://eur03](https://eur03)...C01

Then I would like to store the other capture groups in a field of their own as well such as:  
URL.1.protocol = \> https  
URL.1.domain =\> [windscribe.com](http://windscribe.com)  
URL.1.path = /img...gif  
URL.2.protocol =\> https  
URL.2.domain =\> eur03...com  
URL.2.path =\> /?url=https...yw

I am using [http://rubular.com/](http://rubular.com/) to test my regex, and it works great!

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 7, 2018, 3:50am UTC](https://discuss.elastic.co/t/using-regex-for-multiple-matches-to-store-in-single-field-or-dynamic-fields/151742/2 "2018-11-07T03:50:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.