---
title: "Element: patterns"
url: "https://axoflow.com/docs/axosyslog-core/4.28/chapter-parsers/chapter-patterndb/reference-parsers-pattern-databases/reference-patterndb-schemes/patterndb-scheme-patterns2/"
last_modified: "2026-09-23T16:42:00+02:00"
---

> For the complete documentation index, see [llms.txt](https://axoflow.com/docs/axosyslog-core/4.28/llms.txt).

# Element: patterns

## Location

/[patterndb](https://axoflow.com/docs/axosyslog-core/4.28/chapter-parsers/chapter-patterndb/reference-parsers-pattern-databases/reference-patterndb-schemes/patterndb-scheme-patterndb/index.md)/[ruleset](https://axoflow.com/docs/axosyslog-core/4.28/chapter-parsers/chapter-patterndb/reference-parsers-pattern-databases/reference-patterndb-schemes/patterndb-scheme-ruleset/index.md)/[rules](https://axoflow.com/docs/axosyslog-core/4.28/chapter-parsers/chapter-patterndb/reference-parsers-pattern-databases/reference-patterndb-schemes/patterndb-scheme-rules/index.md)/[rule](https://axoflow.com/docs/axosyslog-core/4.28/chapter-parsers/chapter-patterndb/reference-parsers-pattern-databases/reference-patterndb-schemes/patterndb-scheme-rule/index.md)/*patterns*

## Description

An element containing the patterns of the rule. If a `<patterns>` element contains multiple `<pattern>` elements, the class of the `<rule>` is assigned to every syslog message matching any of the patterns.

## Attributes

N/A

## Children

- *pattern*: A pattern describing a log message. This element is also called `message pattern`. For example:

  ```shell
      <pattern>+ ??? root-</pattern>
  ```

  > **Note:**
  > Support for XML entities is limited, you can use only the following entities: `\&amp; \&lt; \&gt; \&quot; \&apos;`. User-defined entities are not supported.
- *description*: OPTIONAL — A description of the pattern or the log message matching the pattern.
- *urls*
- *values*
- *examples*

## Example

```shell
   <patterns>
        <pattern>Accepted @QSTRING:SSH.AUTH_METHOD: @ for@QSTRING:SSH_USERNAME: @from\ @QSTRING:SSH_CLIENT_ADDRESS: @port @NUMBER:SSH_PORT_NUMBER:@ ssh2</pattern>
    </patterns>
```

Last modified September 23, 2026: [Formatting fixes (4b066aca)](https://github.com/axoflow/axosyslog-core-docs/commit/4b066aca197deb5a17c7eb1a56bfae5f8b983172)