Grok until first period

[uklipse (Mike Jones)]

Hi, new to creating parsing rules so bear with me. I need to parse up until the first period but can't seem to make it work. Below is what I'm trying to parse.

GlobalProtect gateway user authentication succeeded. Login from: 1.2.3.4

I've tried various forms of %{GREEDYDATA}. but I it seems to only go to the last period and not the first. If I set it as %{GREEDYDATA}: it works to the only colon but just need some help when there are multiples of a character.

Thanks!

[Badger]

Use a custom pattern that explicitly matches anything except a period followed by a period.

grok { match => { "message" => "^(?<someField>[^\.]+)\." } }

[uklipse (Mike Jones)]

Great, that did it!

I'm trying to figure out why this works and from the documentation I think sequence [^.]+means the [ ] match a single character which the ^ negates what follows which is a period (slash because of special character). So it says give me the start of the string up to the . but leave off the period but I'm not sure how the + comes into play. Any insight?

[Badger]

[ ] is a character group. In this case any character except . The + means one or more of the members of the character group.

[uklipse (Mike Jones)]

Thanks, appreciate that!