title: How to split Logstash event containing multiple times the same pattern
body: <p>I'm reading a xml formated input and I'm trying to extract each row of a html table as a separate event.</p>
  
  <p>For example if my input is : </p>
  
  <p><code>&lt;xml&gt; &lt;table&gt; &lt;tr&gt; &lt;td&gt; 1 &lt;/td&gt; &lt;td&gt; 2 &lt;/td&gt; &lt;/tr&gt; &lt;tr&gt; &lt;td&gt; 3 &lt;/td&gt; &lt;td&gt; 4 &lt;/td&gt; &lt;/tr&gt; &lt;/table&gt; &lt;/xml&gt;</code></p>
  
  <p>I want the output to be : </p>
  
  <pre><code>{
         "message" =&gt; "&lt;tr&gt; &lt;td&gt; 1 &lt;/td&gt; &lt;td&gt; 2 &lt;/td&gt; &lt;/tr&gt;",
        "@version" =&gt; "1",
      "@timestamp" =&gt; "2015-03-20T10:30:38.234Z",
            "host" =&gt; "VirtualBox"
  }
  {
         "message" =&gt; "&lt;tr&gt; &lt;td&gt; 3 &lt;/td&gt; &lt;td&gt; 4 &lt;/td&gt; &lt;/tr&gt;",
        "@version" =&gt; "1",
      "@timestamp" =&gt; "2015-03-20T10:30:38.234Z",
            "host" =&gt; "VirtualBox"
  }
  </code></pre>
  
  <p>The problem is I need to split an event into multiple event. Using the split filter didn't work because it removes the string used as "terminator".</p>
  
  <p>I designed a custom grok pattern to extract the content of a html row :
  <code>(?&lt;data&gt;&lt;tr&gt;(.)*?&lt;/tr&gt;)</code></p>
  
  <p>Unfortunatly, this pattern only detects first occurrence and while there's a finite number of occurrences in a single xml, the number of rows is not known in advance.</p>
  
  <p>Having a look at <a href="https://logstash.jira.com/browse/LOGSTASH-703" rel="nofollow">JIRA-703 on logstash website</a> I'm afraid grok can not find a single pattern multiple times.(for now, Mars 2015)</p>
  
  <p>Am I forced to code my own custom filter ? Is it possible to store each match of a grok filter as a new event ?</p>
  
  <p>You can have a look at my filter </p>
  
  <pre><code>    input {
          stdin { }
      }
  
      filter {
          mutate {
              gsub =&gt; ["message", "&lt;tr&gt;", "[split]&lt;tr&gt;"]
          }
          mutate {
              gsub =&gt; ["message", "&lt;/tr&gt;", "&lt;/tr&gt;[split]"]
          }
          split {
              terminator =&gt; "[split]"
          }
          grok {
              patterns_dir =&gt; "../patterns"
              #voir pourquoi le meme pattern plusieurs fois ne fonctionne pas
              #https://logstash.jira.com/browse/LOGSTASH-703
              match =&gt; ["message", "%{HTML_ROW_LINE:data}" ]
          }
      }
  
      output {
          stdout {
              codec =&gt; rubydebug
          }
      }
  </code></pre>
  
  <p>I find that when I split the event before and after the line, the grok filter seems to not work anymore. I indeed retrieve what I want in the "message" field but no longer in the "data" field as wanted.</p>
  
  <p>The strange thing is that I don't get a "_grokparsefailure" tag while I don't get a data field. This seems to indicate that there actually is a match, but it's not stored in a field.</p>