It's your .+ at the beginning: it will always match the largest possible thing it can. In this case, it can match all the way up to the Protocol section, so it does. Change it to .+? and you'll be on the right track. The additional question mark tells the .+ to match the smallest possible thing it can. However, now the capturing (.+) will try to grab the largest possible match, so it will end up with "admin ] Protocol [ Telnet".

I think the negated character class [^\]]+ would be a better choice (grab as many non-brackets as possible) to match everything inside the brackets without risk of flowing over into the next set of brackets.     s/.+?\[\s+([^\]]+)\s+\].+/$1/; This works for me and results in 'admin'.

Also, as Mr. Muskrat demonstrates, this is not quite the right realm for a s///, you should probably be just using a match and capturing what you want.

blokhead