-1

what is full match regex(python) to find URI only from nginx logs?

00.00.00.00 - - [23/Mar/2020:16:23:04 +0000] "GET /foo/bar/uri.js?id=123 HTTP/1.1" 200 19165 "https://nginx.com/foo/bar" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36" "00.00.00.00" 0.000

00.00.00.00 - - [23/Mar/2020:16:23:04 +0000] "GET /foo/bar/uri HTTP/1.1" 200 19165 "https://nginx.com/foo/bar" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36" "00.00.00.00" 0.000

00.00.00.00 - - [23/Mar/2020:16:23:04 +0000] "GET /foo/bar/uri.png HTTP/1.1" 200 19165 "https://nginx.com/foo/bar" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36" "00.00.00.00" 0.000

full match regex should give below

/foo/bar/uri.js?id=123
/foo/bar/uri
/foo/bar/uri.png

example for full match regex: https://regex101.com/r/kEOx1U/3

RV Sai
  • 1
  • 1

1 Answers1

0

The regex to match that URIs is the following (click here):

(?<=GET )([^ ]*)

Clearly, if you want to not only match, but also extract, which means deleting all the rest, you have match it too (click here):

.*(?<=GET )([^ ]*).*

and use $1 in the substitution (in Perl; if you need Python, then use \1).

Enlico
  • 23,259
  • 6
  • 48
  • 102