Google SecOps parsers gain a match_all option

09-15month and day

What happened

Google Security Operations release notes dated 2026-09-15 say the Grok parser filter gains a match_all option that extracts all non-overlapping matches in a field (release notes read 2026-11-03).

It is a parser syntax change. Parsers decide which fields a rule or a playbook can use, so a team that parses its own logs can pull more values from one field.

What it changes for a buyer

Almost nothing for a buyer comparing containment. It matters to a team that writes its own parsers and wants more indicators from one log field to reach response playbooks. It is recorded here because it falls inside the 90-day window and changes no score.

All notes are on the updates page. The scores on this site change only when a vendor-controlled page changes; see the corrections log.