Seems to be complicated regex day

[dbcase]

Hi,

I have this data

10.210.192.15 - - [26/Sep/2017:19:59:59 -0400] "POST /rest/icontrol/sites/315568/network/instances/100876ffe9572a.0/functions/disarm HTTP/1.1" 202 9 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Mobile/14G60" "

10.210.192.5 - - [26/Sep/2017:19:59:59 -0400] "POST /rest/icontrol/sites/4793/network/instances/140024460000052928.10.0/functions/thermostatStatus HTTP/1.1" 202 9 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Mobile/14G60" "-"  "-"


6:59:59.000 PM  
10.210.192.15 - - [26/Sep/2017:19:59:59 -0400] "GET /rest/icontrol/sites/4793/network/lights/getAllLightingStatus HTTP/1.1" 202 9 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Mobile/14G60" "-"  "-"

I need to extract out the numbers

315568
4793

and then I need to extract

disarm
thermostatStatus
getAllLightingStatus

I have the number extraction

rex "\/rest\/icontrol\/sites\/(?<number>\d+)"

but the other one I'm at a loss...... Any regex guru's to the rescue?

[DalJeanis · Accepted solution]

Thought I already did that one... ?

|  rex "\/rest\/icontrol\/sites\/(?<number>\d+)\/(<myfield>[^\/\s]+)\sHTTP"

[dbcase]

Hi DalJeanis,

You answered another one which was perfect! This one is a bit different.

I need to extract the last portion of the URL immediately before the HTTP. For example:

In the first event, I need to extract the word "disarm"