How to rex a value in a request uri with a variable value in the middle?

[mark_groenveld]

We are looking to provide the last part of a request uri that identifies a file name and has a client identifier variable in the middle of the uri.

Sample uri request:
GET /someportal/rest/product/v1_0/clientidentifier/filename/fnm_123456789abcd.png HTTP/1.1

The underlined text is the value that I need to extract.  Note the space after the .png.

My current attempt is this:
index=index source=/source sourcetype=sourcetype | rex field=_raw "GET /someportal/rest/product/v1_0/*/filename/(?<FileName>\d+)"

Please let me know how far off I am.  Thanks

[ITWhisperer · Accepted solution]

You were close

| rex "GET \/someportal\/rest\/product\/v1_0\/.*\/filename\/(?<FileName>\S+)"

You should escape slashes, the asterisk is a greedy match but needs an any character preceding it, and the filename should be \S for any non-white-space ("note the space after the .png")

regex101.com is a good place to try out regex - it doesn't get it exactly right when treating backslahes, but it is pretty close https://regex101.com/r/fKABZf/1 

[mark_groenveld]

That worked.  Many thanks!