Extractors - Grok with Regex get first matching string

[rake]

I’m using a custom Grok rule to extract a value from the log message using regex (Graylog version 2.2.3). When there is more than one match, the extractor is always gives the last matched string as result output. Is there any way I can get the first matched string as output?

For example:
[8/1/17 14:53:23:457 GMT] 00000192 TestServer A Some message contain 1 as integer.

I want to extract the A, so I’m using the following regex in the extractor logic: (\s{1,2}[EWA123]{1}\s) unfortunately this regex also matches 1. I’m looking for a way to get the first matching result not the last matching result.

[jtkarvo]

if the message after the wanted match always starts with “Some”, you can use that in your regex. If everythin else fails, you can use something like

(\s{1,2}[EWA123]{1}\s).*\s{1,2}[EWA123]{1}\s

but it might be slow.

[rake]

That “Some” was an example. There is no constant word after A.