Hi! You can use standard regular expression syntax here (the Java flavor). Simply anchor the regex at the end of the string.
/(\w+)$ <smb:///(/w+)$> That should do the trick, you can verify in the extractor builder. cheers, -k > On 12 Sep 2015, at 20:02, Sriranga Kulkarni <[email protected]> wrote: > > I want to extract the last field of the message . For example if i have > message as below > > /api/provider/brand - In this case i want the field to be 'brand' > > but the message format may differ in the above example it has 3 parameters i > want the 3rd but there will be messages where there will be 4 parameters so i > am looking for expression which captures last field irrespective of how many > parameters it has it should start from last and capture the field starting > from last > > -- > You received this message because you are subscribed to the Google Groups > "Graylog Users" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected] > <mailto:[email protected]>. > To view this discussion on the web visit > https://groups.google.com/d/msgid/graylog2/2ce4a204-1c4b-4abf-a27f-2227aadcc6c5%40googlegroups.com > > <https://groups.google.com/d/msgid/graylog2/2ce4a204-1c4b-4abf-a27f-2227aadcc6c5%40googlegroups.com?utm_medium=email&utm_source=footer>. > For more options, visit https://groups.google.com/d/optout > <https://groups.google.com/d/optout>. -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/BD50B670-B0B4-42B4-9575-5182689F6A05%40gmail.com. For more options, visit https://groups.google.com/d/optout.
