This pattern might do what you need.  (?ms)(?<=^(TO|INFO)\s).*?(?=\s+^(?:INFO|GR)\s) It will only work reliably if there are no two other lines starting with TO, INFO or GR in the message body, i.e. after the first GR. It will return one or two matches, depending on the presence of the INFO part.  You will have to split those ...