Google SecOps grok filter gains a match_all option
Google Security Operations release notes dated 2026-09-15 add a match_all option to the grok parser filter. The option extracts all non-overlapping matches in a field (Google release notes, read 2026-11-03).
A parser change moves which fields a rule can see. Rules in Google SecOps run over parsed data, so a parser edit is the kind of schema change that can make a rule go quiet. The release note describes a syntax option, not a change that breaks rules.
Source: docs.cloud.google.com read 2026-11-04
What it changes for a buyer
If you edit a parser, replay the rules that read its fields before and after. The release note adds a capability and carries no warning for existing rules.
Where this stands on the rubric
Current rubric standing of the platforms this note names.
| Platform | Total, of 10 | Matrix, of 33 | Rule health, of 5 |
|---|---|---|---|
| Google Security Operations | 6.83 | 15.0 | 3.5 |
All notes are in the changelog. Spotted something wrong? See corrections.