How to do rex to extract field URL eg.: http://www.gnookcooki.com.br
1366974288.183 102 178.19.3.199 TCP_REFRESH_HIT/200 174 GET http://www.gnookcooki.com.br/images/hat_orange_big.gif teste@teste.com DIRECT/www.gnookcooki.com.br/image/gif 1366974288.184 102 178.19.3.199 TCP_REFRESH_HIT/200 174 GET http://www.gnookcooki.com.br/images-files/hat_orange.jpg teste@teste.com DIRECT/www.gnookcooki.com.br/image/gif
your_search | rex field=_raw "(GET|POST|DELETE|PUT)\s*(?<url>[^\s]*)"
Although, this looks like access_combined, some items should be extracted for you already.
access_combined
Here another one that may work for you as well. (?<uri>(https?|ftp)://[a-zA-Z0-9.\-_]+/[a-zA-Z0-9+&@#/%=~_\-|!:,.;]*)
