title: How to get only the first match of a regex Grok filter
body: <p><strong>goal</strong></p>
  
  <p>I want to retrieve only this string "14" from this message with a logstash Grok</p>
  
  <pre><code>3/03/0 EE 14 GFR 20 AAA XXXXX 50 3365.00
  </code></pre>
  
  <p><strong>this is my grok code</strong></p>
  
  <pre><code>grok{
   match =&gt; {
          field1 =&gt; [
            "(?&lt;number_extract&gt;\d{0}\s\d{1,3}\s{1})"       
          ]         
        }
  }
  </code></pre>
  
  <p>I would like to match just the first match "14" but my Grok filter returns all matches:</p>
  
  <pre><code>14 20 50
  </code></pre>