I am using the nginx contentpack from the market place to get my nginx logs into graylog. That being said, for better analysing purposes I would like to have only the hostname of the referrer rather than the complete referrer.
The extractor provided by the contentpack for the referrer is the following:
nginx:.+?HTTP/\S+" \d+ \d+ \"(.+?)\"
I am not able to conclude from this which part is the hostname here. Any guidance is appreciated.