extract text between two slashes from the end


hi I am trying to extract the email id from the text
eg: PUT /api/users/usernames/
PUT /api/users/usernames/
POST /api/users/

Tags (1)
0 Karma

This should give you what you are looking for:

your base search
| rex field=_raw "(?<email_address>[^\/]+%40[^\/]+)"
| eval email_address=urldecode(email_address)

The rex looks for anything between slashes that contains the urlencoded @ sign: %40 and then the urldecode function will translate that into a usable email address.

0 Karma


Can you try this rex:

 | rex field=_raw "(?<emailaddr>[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+)
0 Karma