Extract Field URL

[erick_costa]

How to do rex to extract field URL eg.: http://www.gnookcooki.com.br

1366974288.183 102 178.19.3.199 TCP_REFRESH_HIT/200 174 GET http://www.gnookcooki.com.br/images/hat_orange_big.gif teste@teste.com DIRECT/www.gnookcooki.com.br/image/gif
1366974288.184 102 178.19.3.199 TCP_REFRESH_HIT/200 174 GET http://www.gnookcooki.com.br/images-files/hat_orange.jpg teste@teste.com DIRECT/www.gnookcooki.com.br/image/gif

[alacercogitatus]

your_search | rex field=_raw "(GET|POST|DELETE|PUT)\s*(?<url>[^\s]*)"

Although, this looks like access_combined, some items should be extracted for you already.

[bmacias84]

Here another one that may work for you as well.
(?<uri>(https?|ftp)://[a-zA-Z0-9.\-_]+/[a-zA-Z0-9+&@#/%=~_\-|!:,.;]*)