# Element: patterns

## Location

/[patterndb](../../../../../docs/axosyslog-core/chapter-parsers/chapter-patterndb/reference-parsers-pattern-databases/reference-patterndb-schemes/patterndb-scheme-patterndb/index.md)/[ruleset](../../../../../docs/axosyslog-core/chapter-parsers/chapter-patterndb/reference-parsers-pattern-databases/reference-patterndb-schemes/patterndb-scheme-ruleset/index.md)/[rules](../../../../../docs/axosyslog-core/chapter-parsers/chapter-patterndb/reference-parsers-pattern-databases/reference-patterndb-schemes/patterndb-scheme-rules/index.md)/[rule](../../../../../docs/axosyslog-core/chapter-parsers/chapter-patterndb/reference-parsers-pattern-databases/reference-patterndb-schemes/patterndb-scheme-rule/index.md)/_patterns_

## Description

An element containing the patterns of the rule. If a __element contains multiple * lements, the class of the *»>ssigned to every syslog message matching any of the patterns.

## Attributes

N/A

## Children

  * _pattern_ : A pattern describing a log message. This element is also called `message pattern`. For example:
```
 <pattern>+ ??? root-</pattern>
        
```

Note Support for XML entities is limited, you can use only the following entities: `\&amp; \&lt; \&gt; \&quot; \&apos;`. User-defined entities are not supported. 

  * _description_ : OPTIONAL — A description of the pattern or the log message matching the pattern.

  * _urls_

  * _values_

  * _examples_




## Example
```
       <patterns>
            <pattern>Accepted @QSTRING:SSH.AUTH_METHOD: @ for@QSTRING:SSH_USERNAME: @from\ @QSTRING:SSH_CLIENT_ADDRESS: @port @NUMBER:SSH_PORT_NUMBER:@ ssh2</pattern>
        </patterns>
    
```

Last modified July 2, 2023: [Change highlight mode of code examples (2f8a9593)](<https://github.com/axoflow/axosyslog-core-docs/commit/2f8a95937c6498193e7168ce8b0dc831e9f0f8ad>)