# Return Group1 from regex not fullmatch
**URL:** https://discuss.elastic.co/t/return-group1-from-regex-not-fullmatch/224420
**Category:** Beats
**Tags:** filebeat
**Created:** [March 20, 2020, 12:54pm UTC](https://discuss.elastic.co/t/return-group1-from-regex-not-fullmatch/224420 "2020-03-20T12:54:51Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@quixter](https://discuss.elastic.co/u/quixter)
#### Post date: [March 20, 2020, 12:54pm UTC](https://discuss.elastic.co/t/return-group1-from-regex-not-fullmatch/224420/1 "2020-03-20T12:54:51Z")
Hi,
I'm pretty new to both ELK and Filebeat. I'm trying to get a custom field built using a regex value. I'm having to use javascript which seems to be complicating things. I have the following regex **.com/([A-Za-z0-9]+)/** it returns .com/clientname/ as a fullmatch and clientname as the group one match. The group 1 match is the desired match for the custom field. Is there a way to do that. Below is what I have in the filebeat yml.
processors:
- script:
lang: javascript
id: clientid\_regex
source: \>
function process(event) {
var cid;
var message;
message=event.Get("message");
if ( cid = message.match(/.com/([A-Za-z0-9]+)//) ) {
event.Put("rcm.clientid", cid);
}
}
---
### Author:  [@shaunak](https://discuss.elastic.co/u/shaunak)
#### Post date: [March 23, 2020, 5:36pm UTC](https://discuss.elastic.co/t/return-group1-from-regex-not-fullmatch/224420/2 "2020-03-23T17:36:03Z")
Hi @quixter, welcome to the Elastic Community Forums!
To extract groups in Javascript I think you'll want to use `RegExp.prototype.exec()` instead of `String.prototype.match()`. See [https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular\_Expressions/Groups\_and\_Ranges#Using\_groups](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions/Groups_and_Ranges#Using_groups) for an example.
Hope that helps,
Shaunak
---
### Author:  [@quixter](https://discuss.elastic.co/u/quixter)
#### Post date: [March 23, 2020, 6:03pm UTC](https://discuss.elastic.co/t/return-group1-from-regex-not-fullmatch/224420/3 "2020-03-23T18:03:47Z")
Hi and thanks for the reply. I will explore tat and see if I can figure it out. Been pretty bad at this thing called coding so far. 🙂
---
### Author:  [@shaunak](https://discuss.elastic.co/u/shaunak)
#### Post date: [March 23, 2020, 6:50pm UTC](https://discuss.elastic.co/t/return-group1-from-regex-not-fullmatch/224420/4 "2020-03-23T18:50:09Z")
> [@quixter](#):
>
> Been pretty bad at this thing called coding so far. 🙂
Eh, I'm sure you're doing fine. Computers are hard, and Javascript is harder 😉.
Please post here if you can't get it working. We're here to help!
Shaunak
---
### Author:  [@quixter](https://discuss.elastic.co/u/quixter)
#### Post date: [April 6, 2020, 1:48pm UTC](https://discuss.elastic.co/t/return-group1-from-regex-not-fullmatch/224420/5 "2020-04-06T13:48:25Z")
I was able to use groups to return it correctly. Simply added [2].
```
message=event.Get("message");
if ( cid = message.match(/.(com)\/([A-Za-z0-9]+)\//) ) {
event.Put("rcm.clientid", cid[2]);
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 4, 2020, 1:48pm UTC](https://discuss.elastic.co/t/return-group1-from-regex-not-fullmatch/224420/6 "2020-05-04T13:48:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.