How to get first match regex grok

Elastic Stack Logstash
1

Dear all,

I want to retrieve only "14" from this message

3/03/0 EE 14 GFR 20 AAA XXXXX 50 3365.00

this is my grok code

grok{
 match => {
        field1 => [
          "(?<number_extract>\d{0}\s\d{1,3}\s{1})"       
        ]         
      }
}

I would like to match just "14" first match

Best regards

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.