I ended up going with \/\/(?:[^@\/\n]+@)?(?:www\.)?(?<refdomain>[^:\/\n]+) Used it context it looks like method=GET| rex field=referer "\/\/(?:[^@\/\n]+@)?(?:www\.)?(?<refdomain>[^:\/\n]+)"| stats values(refdomain) See the extraction in action https://regex101.com/r/iVrIlL/1 ... View more