title: how to match first regex occurrence using grok filter
body: <p>my logs are in the following format <code>my.package.name classname: my_message</code></p>
  
  <p>I would like to cut the class perfix .</p>
  
  <p>for example:</p>
  
  <p><code>com.example.Handler doPost:  request  received, jim:jay foo: bar</code></p>
  
  <p>convert to:</p>
  
  <p><code>request  received, jim:jay foo: bar</code></p>
  
  <p>I tied this</p>
  
  <pre><code>filter {
    grok {
      match =&gt; {"message" =&gt; "^(.*):%{GREEDYDATA:request}"}
    }
  }
  
  output { stdout { codec =&gt; rubydebug  }}
  </code></pre>
  
  <p>but this is what I get: </p>
  
  <pre><code>{
         "request" =&gt; " bar",
         "message" =&gt; "com.example.Handler doPost:  request  received, jim:jay foo: bar"
         ...
  }
  </code></pre>
  
  <p>seems like grok matches by last regex occurrence.</p>
  
  <p>how can I match by <strong>first</strong> <code>:</code> occurrence?</p>