Regex - discard text after comma character

logstash, logstash-grok, regex

Solution

Use a non-greedy quantifier:

test:(.*?),

Or a character class:

test:([^,]*),

To ignore the comma as well:

test:([^,]*)

If you'd like to omit the `test:` as well you can use a look-behind like this:

(?<=test:\s)[^,]*

Since you're using this grok debugger, I was able to get this to work by using a named capture group:

(?<test>(?<=test:\s)[^,]*)

Problem

If I have the text: ``` test: firstString, blah: anotherString, blah:lastString ``` How can I get the text "firstString" My regex is: ``` test:(.*), ``` EDIT Which brings back `firstString, blah: anotherString,` but I only need to bring back the text 'firstString'?

Original source