I seem to be unable to comment on the similar questions, but as they haven't answered my question, here I go. With the event node=hostname a0=first a1=second a2=third a3=fourth using rex rex max_match=0 field=_raw "node=(?<node>[^\s]+) a0=(?<cmd>[^\s+]+) a[1-9]=(?<args>[^\s]+)" returns node, cmd and only 1 args but rex max_match=0 field=_raw "a[1-9]=(?<args>[^\s]+)" returns all the args Is there are way to achieve the former with args as a multivalue field? ... View more