Feature
Grok filter match_all option in parser syntax
Grok filter match_all option in parser syntax
The Google SecOps parser syntax is updated to support the match_all option within the Grok filter. This allows parsers to extract all non-overlapping pattern occurrences within a field, rather than returning only the first match.
For more information, see Parser syntax reference.
Read the original announcement