Hi! You can use standard regular expression syntax here (the Java flavor). Simply anchor the regex at the end of the string.
/(\w+)$ <smb:///(/w+)$> That should do the trick, you can verify in the extractor builder. cheers, -k > On 12 Sep 2015, at 20:02, Sriranga Kulkarni <srira...@peel.com> wrote: > > I want to extract the last field of the message . For example if i have > message as below > > /api/provider/brand - In this case i want the field to be 'brand' > > but the message format may differ in the above example it has 3 parameters i > want the 3rd but there will be messages where there will be 4 parameters so i > am looking for expression which captures last field irrespective of how many > parameters it has it should start from last and capture the field starting > from last > > -- > You received this message because you are subscribed to the Google Groups > "Graylog Users" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to graylog2+unsubscr...@googlegroups.com > <mailto:graylog2+unsubscr...@googlegroups.com>. > To view this discussion on the web visit > https://groups.google.com/d/msgid/graylog2/2ce4a204-1c4b-4abf-a27f-2227aadcc6c5%40googlegroups.com > > <https://groups.google.com/d/msgid/graylog2/2ce4a204-1c4b-4abf-a27f-2227aadcc6c5%40googlegroups.com?utm_medium=email&utm_source=footer>. > For more options, visit https://groups.google.com/d/optout > <https://groups.google.com/d/optout>. -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/BD50B670-B0B4-42B4-9575-5182689F6A05%40gmail.com. For more options, visit https://groups.google.com/d/optout.
