Stop proccesing events/lines after first grok match

[Badger]

In that case use ruby and scan

ruby { code => 'event.set("anArray", event.get("message").scan(/someRegexp/))' }

then pick whichever member of the array that you want.