hi I am trying to extract the email id from the text
eg: PUT /api/users/usernames/eejuy.alves92%40gmail.com/
This should give you what you are looking for:
your base search
| rex field=_raw "(?<email_address>[^\/]+%40[^\/]+)"
| eval email_address=urldecode(email_address)
The rex looks for anything between slashes that contains the urlencoded @ sign: %40 and then the urldecode function will translate that into a usable email address.
Can you try this rex:
| rex field=_raw "(?<emailaddr>[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+)