Search code examples
regexlogstashlogstash-grok

Regex - discard text after comma character


If I have the text:

test: firstString, blah: anotherString, blah:lastString

How can I get the text "firstString"

My regex is:

 test:(.*),

EDIT Which brings back firstString, blah: anotherString, but I only need to bring back the text 'firstString'?


Solution

  • Use a non-greedy quantifier:

    test:(.*?),
    

    Or a character class:

    test:([^,]*),
    

    To ignore the comma as well:

    test:([^,]*)
    

    If you'd like to omit the test: as well you can use a look-behind like this:

    (?<=test:\s)[^,]*
    

    Since you're using this grok debugger, I was able to get this to work by using a named capture group:

    (?<test>(?<=test:\s)[^,]*)