rex stop after first match

[poisar]

i have a field with several strings like

fieldname = AT-field2-field3

fieldname = DE-field2

fieldname = DE-field2-field3-field4

etc...

I try to get a rex to just get the country code:

|rex field=fieldname "^(?<country>.*)-.*"

but the result is not just the  Country Code

any ideas?

[richgalloway · Accepted solution]

The .* operator is greedy so it will grab as many characters as it can that still match the expression.  One solution is to use the non-greedy quantifier.

|rex field=fieldname "^(?<country>.*?)-.*"

Another solution is to take everything up to the first hyphen.  Like this:

| rex field=fieldname "^(?<country>[^-]+)-"

[poisar]

thank you for your input. Both variants work and i learned something new 🙂