Logstash pattern dealing with multiple matches

Question

Facing very much difficulty to extract in grok

hi i am good [anything] hey [another] hii [third] kjkj [fourth]  etc

in the above string how can i extract [anything] to one field
have used (^.+)(?<thread_name>\[.+\]) but it extracts last match

Answer 1

(^[^\[]+)(?<thread_name>\[[^\]]+\])

This one is modified yours. It will work to extract exactly first match of a word in square brackets. Please provide more details if you need a more tuned pattern.

Output will be:

{
  "thread_name": [
    [
      "[anything]"
    ]
  ]
}

I recommend using the Grok Debugger for quick checking grok patterns.