title: How do I refer to a regex group inside a custom grok pattern?
body: <p>I want to add fields for specific URI params in my log lines</p>
  
  <p>here is an example log line:</p>
  
  <pre><code>2017-03-12 21:34:36 W3SVC1 webserver 1.1.1.1 GET /webpage.html param1=11111&amp;param2=22222&amp;param3=&amp;param4=4444444 80 - 2.2.2.2 HTTP/1.1 Java/1.8.0_121 - - balh.com 200 0 0 311 244 247 - -
  </code></pre>
  
  <p>I want to add fields for param1, param2, param3 and param4.</p>
  
  <p>I am using this grok filter:</p>
  
  <pre><code>  grok {
      match =&gt; [ "message", "(?&lt;param1&gt;param1=(.*?)&amp;)"]
    }
  </code></pre>
  
  <p>So this regex uses a capture group to get text between "param1=" and "&amp;". But grok is ignoring the capture group and getting "param1=11111&amp;" I just want to capture the "111111"</p>
  
  <p>How can I say use capture group 1 or tell grok to use my regex capture group?</p>
  
  <p>Edit
  This almost works:</p>
  
  <pre><code>  grok {
      match =&gt; [ "message", "(?&lt;param1&gt;param1=(?&lt;param1&gt;.*?)&amp;)"]
    }
  </code></pre>
  
  <p>So I <em>guess</em> what I'm doing here is using two named groups but with the same name. The problem is that the "param1" field has two entries in it for each group. One for "param1=11111&amp;" and one for "11111". How do I just get that second group?</p>