Extracting name out of http_request

[vmishra]

Need help extracting "test" out of - http_request="POST /rest/api/test/*"
Thanks,

[richgalloway]

'rex field=http_request "POST\s/rest/api/(?<method>.*?)/"'

[richgalloway]

Great! Please accept the answer.

[vmishra]

thanks it worked