# Capturing only first group in Logstash regex
**URL:** https://discuss.elastic.co/t/capturing-only-first-group-in-logstash-regex/184214
**Category:** Logstash
**Created:** [June 4, 2019, 3:04pm UTC](https://discuss.elastic.co/t/capturing-only-first-group-in-logstash-regex/184214 "2019-06-04T15:04:23Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@f4fe5bb60e3686943680](https://discuss.elastic.co/u/f4fe5bb60e3686943680)
#### Post date: [June 4, 2019, 3:04pm UTC](https://discuss.elastic.co/t/capturing-only-first-group-in-logstash-regex/184214/1 "2019-06-04T15:04:23Z")
Hello everyone!
Can someone explain me next please.
I have log:
> "bool":{"must":[{"bool":{"should":[{"codesearch\_score\_query":{"query\_id":"9baec4c4-d910-4023-899e-5a580bfbd3a3","query":{"term":{"content":"copy"}}}},{"function\_score":{"boost":10000000,"query":{"term":{"fileName":{"\_name":"fileName\_copy","value":"copy"}}}}}]}},{"bool":{"should":[{"codesearch\_score\_query":{"query\_id":"9baec4c4-d910-4023-899e-5a580bfbd3a3","query":{"term":{"content":"new"}}}},{"function\_score":{"boost":10000000,"query":{"term":{"fileName":{"\_name":"fileName\_new","value":"new"}}}}}]}},{"bool":{"should":[{"codesearch\_score\_query":{"query\_id":"9baec4c4-d910-4023-899e-5a580bfbd3a3","query":{"term":{"content":"version"}}}},{"function\_score":{"boost":10000000,"query":{"term":{"fileName":{"\_name":"fileName\_version","value":"version"}}}}}]}},{"bool":{"should":[{"codesearch\_score\_query":{"query\_id":"9baec4c4-d910-4023-899e-5a580bfbd3a3","query":{"term":{"content":"and"}}}},{"function\_score":{"boost":10000000,"query":{"term":{"fileName":{"\_name":"fileName\_and","value":"and"}}}}}]}},{"bool":{"should":[{"codesearch\_score\_query":{"query\_id":"9baec4c4-d910-4023-899e-5a580bfbd3a3","query":{"term":{"content":"install"}}}},{"function\_score":{"boost":10000000,"query":{"term":{"fileName":{"\_name":"fileName\_install","value":"install"}}}}}]}},{"bool":{"should":[{"codesearch\_score\_query":{"query\_id":"9baec4c4-d910-4023-899e-5a580bfbd3a3","query":{"term":{"content":"previous"}}}},{"function\_score":{"boost":10000000,"query":{"term":{"fileName":{"\_name":"fileName\_previous","value":"previous"}}}}}]}},{"bool":{"should":
and regex:
```
grok {
match => { "[Query_body]" => "(?<=fileName)(?.*)"}
}
```
It matching many times but i need only first group. How i can to do this? If it possible.
Sorry for my English.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 4, 2019, 5:46pm UTC](https://discuss.elastic.co/t/capturing-only-first-group-in-logstash-regex/184214/2 "2019-06-04T17:46:56Z")
If you just want the "copy" from filename\_copy then you could use
```
grok { match => { "message" => '(?<=fileName_)(?.+?)"' } }
```
---
### Author:  [@f4fe5bb60e3686943680](https://discuss.elastic.co/u/f4fe5bb60e3686943680)
#### Post date: [June 5, 2019, 5:40am UTC](https://discuss.elastic.co/t/capturing-only-first-group-in-logstash-regex/184214/3 "2019-06-05T05:40:32Z")
Hi, thanks for response.
With this pattern i have many matches like on screenshot.
I need take only first or concatenate all matches to array like
[
"1 value",
"2 value",
...
etc
]
---
### Author:  [@f4fe5bb60e3686943680](https://discuss.elastic.co/u/f4fe5bb60e3686943680)
#### Post date: [June 6, 2019, 6:18am UTC](https://discuss.elastic.co/t/capturing-only-first-group-in-logstash-regex/184214/4 "2019-06-06T06:18:05Z")
Can someone help with my problem? Or it impossible in standard Logstash config?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 4, 2019, 6:18am UTC](https://discuss.elastic.co/t/capturing-only-first-group-in-logstash-regex/184214/5 "2019-07-04T06:18:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.