/.*=/ /.*?=/ s.gsub(/[^s=]+=/, '') s = '2014-01-09T06:16:53.748849+00:00 heroku[router]: at=info method=POST fwd="94.66.255.106" dyno=web.12 connect=12ms service=21ms status=200 bytes=78' puts s.gsub(/[^s=]+=/, '') # => 2014-01-09T06:16:53.748849+00:00 heroku[router]: info POST "94.66.255.106" web.12 12ms 21ms 200 78