How can I extract just a section of a field?

[mark_groenveld]

I have a key called message

Inside the value are several results but I need to only extract one result in the middle of the results.

Sample:
message:  template: 1234abcd, eeid: 5678efgh, consumerid: broker

My rex is below but returns the template value but also the results for eeid  and consumerid when I only need the template value of 1234abcd.

| rex field=message "template: (?<TemplateID>[^-]+)"

[dtburrows3 · Accepted solution]

I think this regex will capture just the value for template.

\s+template:\s+([^,]+)


The character after the carrot inside the square brackets means match on a character not in this list.
And adding a "+" after is a quantifier for 1 or more times. 

So doing "template: (?<TemplateID>[^-]+)" is matching on all characters after 'template: ' up until a "-" (which I dont see one in the example. So replacing the "-" with a "," I think will extract the value as intended.

[mark_groenveld]

That worked.  Thanks dtburrows3!