title: Extracting last word/text multiple matching logstash
body: <p>I have a Logstash pipeline for ingesting a whole file, multiline code used. I would like to get all matching events and extract only the last word or text. I can't get any regular expression working.</p>
  
  <p><strong>File content</strong></p>
  
  <pre><code>some line extract this 875846 85746,857
  some other line
  some other line with more text
  let's extract this 887362        24153,44737
  some other final line
  </code></pre>
  
  <p><strong>Required match</strong></p>
  
  <p>Finding all lines containing "extract this" and retrieve last word/text</p>
  
  <p><strong>Expected output</strong></p>
  
  <pre><code>{
      "patternmatch1" =&gt; [
          [0] [
              [0] "85746,857"
          ],
          [1] [
              [0] "24153,44737"
          ]
      ],
         "@timestamp" =&gt; 2020-01-14T11:15:34.304Z
  }
  </code></pre>
  
  <p><strong>Logstash pipeline</strong></p>
  
  <pre><code>input {
      file{
          path =&gt; "C:/file.txt"
          start_position =&gt; "beginning"
          sincedb_path =&gt; NUL
          codec =&gt; multiline { 
              pattern =&gt; "^nomatching"
              negate =&gt; true
              what =&gt; previous
              auto_flush_interval =&gt; 1
              multiline_tag =&gt; ""
          }
      }
  }
  filter {
    ruby { code =&gt; 'event.set("patternmatch1",event.get("message").scan(/extract this([^\r]*)/))' }
  }
  output {   
    stdout { codec =&gt; rubydebug } 
  }
  </code></pre>
  
  <p><strong>The current output</strong></p>
  
  <pre><code>{
      "patternmatch1" =&gt; [],
       "message" =&gt; "some line extract this 875846 85746,857\r\nsome other line\r\nsome other line with more text\r\nlet's extract this 887362        24153,44737\r\nsome other final line\r\n\r",
     "@timestamp" =&gt; 2020-01-14T11:44:50.140Z
  }
  </code></pre>