# Extractor catch next occurence

**URL:** <https://community.graylog.org/t/extractor-catch-next-occurence/5820>\
**Category:** Graylog Central (peer support)\
**Created:** [June 29, 2018, 8:37am UTC](https://community.graylog.org/t/extractor-catch-next-occurence/5820 "2018-06-29T08:37:39Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![A3TH3RIUS](https://avatars.discourse-cdn.com/v4/letter/a/c5a1d2/32.png) [@A3TH3RIUS](https://community.graylog.org/u/A3TH3RIUS)\
**Post date:** [June 29, 2018, 8:37am UTC](https://community.graylog.org/t/extractor-catch-next-occurence/5820/1 "2018-06-29T08:37:39Z")

</div>

I want to use regex to catch the account name on this log file

`Jun 28 15:48:17 <ServerName> Microsoft-Windows-Security-Auditing [476] Failed to log in to an account. Topic: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Logon Type: 3 Account for which logon was unsuccessful: Security ID: S-1-0-0 Account Name: **<AccountName I want>** Account Domain: XXXXXXXX Failure Information: Reason for Failure: Unknown username or incorrect password. State: 0xC000006D Sub state: 0xC0000064`

I tried this :

```
`(?: Account Name.:..)"?([a-zA-Z0-9.-.@._.-]{1,})...... Account Area .... ([a- zA-Z0-9 .-. @ ._.-] {1,}) ... Login ID "?`

```

but I can’t catch the second occurence, i get only : `-` from the first occurence…

If someone can help me…

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [June 29, 2018, 9:42am UTC](https://community.graylog.org/t/extractor-catch-next-occurence/5820/2 "2018-06-29T09:42:58Z")

</div>

extractors catch only the **FIRST** group, that is one of their limitations.

That is written by the way at the UI.

> First matcher group is used

You might want to switch to the processing pipelines to work around this limitation.

---

<div class="post-metadata">

**Author:** ![A3TH3RIUS](https://avatars.discourse-cdn.com/v4/letter/a/c5a1d2/32.png) [@A3TH3RIUS](https://community.graylog.org/u/A3TH3RIUS)\
**Post date:** [June 29, 2018, 12:32pm UTC](https://community.graylog.org/t/extractor-catch-next-occurence/5820/3 "2018-06-29T12:32:24Z")

</div>

Thanks for your answer.  
I made an exctrator substring and I managed to catch the account name.

Thanks again for your help .

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [July 13, 2018, 12:32pm UTC](https://community.graylog.org/t/extractor-catch-next-occurence/5820/4 "2018-07-13T12:32:27Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.