using: http://grokdebug.herokuapp.com input: a,b,c,d,e,f pattern: %{WORD:x},%{WORD:x}, result: { "x": [ [ "a", "b" ] ] } input: a,b,c,d,e,f pattern: (?:%{WORD:x},){2} result: { "x": [ [ "b" ] ] } so something like (?:%{WORD:x},)*%{WORD:x} is a non-starter. Thanks grok. Throk.