extract text between two slashes from the end

[sravani27]

hi I am trying to extract the email id from the text
eg: PUT /api/users/usernames/eejuy.alves92%40gmail.com/
PUT /api/users/usernames/acvf.bbss%40xyz123.com.br/
POST /api/users/jabcd%40xyz.edu.br/passwords

[elliotproebstel]

This should give you what you are looking for:

your base search
| rex field=_raw "(?<email_address>[^\/]+%40[^\/]+)"
| eval email_address=urldecode(email_address)

The rex looks for anything between slashes that contains the urlencoded @ sign: %40 and then the urldecode function will translate that into a usable email address.

[p_gurav]

Can you try this rex:

 | rex field=_raw "(?<emailaddr>[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+)