How to edit the syntax for my rex search to extract the folder name from a source path?

[Federica_92]

Hi everyone,

I'm struggling with this rex expression:

 query | rex field=source  "/var/syslog*(?<remote_source>\w+)/*.log"

  /var/syslog/name_folder/2015-08-11.log

I need to get the folder name. Could someone please help me to correct this regex?

Thank you a lot! : )

[woodcock · Accepted solution]

Like this:

query | rex field=source  "^\/(?:[^\/]+\/){2}(?<remote_source>[^\/]+)\/"

[richgalloway]

Don't forget the escape characters.

^\/(?:[^\/]+\/){2}([^\/]+)\/

[woodcock]

quite correct; Fixed another markdown mistake, too (answer updated and tested).

[Federica_92]

Thank you : )