Logstash grok parse doesn't parse error code

[EZprogramming (Kourosh Azizi)]

Logstash version: 7.0.1

Given filename => "EUI106_occurances", I want to have code => "EUI106".

The following grok parse filter doesn't work:

filter{
   grok {
      match => { "filename", "%{POSTFIX_QUEUEID:code}" }
   }
}

[EZprogramming (Kourosh Azizi)]

grok {
    match => ["filename","%{GREEDYDATA}/%{GREEDYDATA:code}\_occurances"]
}

or

grok {
    match => ["filename","%{GREEDYDATA}/%{GREEDYDATA:code}"]
}
mutate {
    gsub => ["code", "_occurances", ""]
}