# Grok Expression "match anything until you find a number"

**URL:** <https://discuss.elastic.co/t/grok-expression-match-anything-until-you-find-a-number/297612>\
**Category:** Logstash\
**Created:** [February 18, 2022, 1:39pm UTC](https://discuss.elastic.co/t/grok-expression-match-anything-until-you-find-a-number/297612 "2022-02-18T13:39:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Andrea\_Bozzano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrea_bozzano/32/73731_2.png) [@Andrea\_Bozzano](https://discuss.elastic.co/u/Andrea_Bozzano)\
**Post date:** [February 18, 2022, 1:39pm UTC](https://discuss.elastic.co/t/grok-expression-match-anything-until-you-find-a-number/297612/1 "2022-02-18T13:39:44Z")

</div>

Hi everyone, and thank you for your help.

I'm struggling a bit because I can't write a correctly matching for Grok for this kind of pattern.  
The logs I'm trying to process are structured like this (they're IP addresses):

```auto
2022-02-17 08:31:32 11.12.13.14 one_word 15.16.17.18 otherstuff
2022-02-17 09:31:32 11.12.13.14 one or more word 15.16.17.18 otherstuff

```

I'm trying to extrapolate just the "one\_word" and the "one or more words" between the two IP addresses, but so far i can just either pick the first word either pick all as greedy data.  
Thank you for any help!

Regards,

Andrea

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 18, 2022, 5:15pm UTC](https://discuss.elastic.co/t/grok-expression-match-anything-until-you-find-a-number/297612/2 "2022-02-18T17:15:41Z")

</div>

To “match anything until you find a number” you could use \D\*

---

<div class="post-metadata">

**Author:** ![Andrea\_Bozzano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrea_bozzano/32/73731_2.png) [@Andrea\_Bozzano](https://discuss.elastic.co/u/Andrea_Bozzano)\
**Post date:** [February 21, 2022, 9:56am UTC](https://discuss.elastic.co/t/grok-expression-match-anything-until-you-find-a-number/297612/3 "2022-02-21T09:56:34Z")

</div>

Thank you @Badger, this was actually what I was looking for 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 21, 2022, 9:57am UTC](https://discuss.elastic.co/t/grok-expression-match-anything-until-you-find-a-number/297612/4 "2022-03-21T09:57:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.