Hostname of nginx referrer

Graylog Add-ons
1

Hi Community,

I am using the nginx contentpack from the market place to get my nginx logs into graylog. That being said, for better analysing purposes I would like to have only the hostname of the referrer rather than the complete referrer.

The extractor provided by the contentpack for the referrer is the following:

nginx:.+?HTTP/\S+" \d+ \d+ \"(.+?)\"

I am not able to conclude from this which part is the hostname here. Any guidance is appreciated.

Cheers,

2

needed extractor: HTTP/\S+" \d+ \d+ "https?:\/\/(.+?)\/.*"

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.