GROK pattern to match URIPATH

Question

Here is my sample URL

http://localhost:8080/abc2/query/errorLogs

was trying to extract only query/errorLogs. For this i have tried below GROK patten

(%{URIPROTO}://%{URIHOST}(?<path>/[^/]+/[^/]+/[^/]+))

Below output i am getting

{
  "URIPROTO": [
    [
      "http"
    ]
  ],
  "URIHOST": [
    [
      "localhost:8080"
    ]
  ],
  "IPORHOST": [
    [
      "localhost"
    ]
  ],
  "HOSTNAME": [
    [
      "localhost"
    ]
  ],
  "IP": [
    [
      null
    ]
  ],
  "IPV6": [
    [
      null
    ]
  ],
  "IPV4": [
    [
      null
    ]
  ],
  "port": [
    [
      "8080"
    ]
  ],
  "path": [
    [
      "/abc2/query/errorLogs"
    ]
  ]
}

but i was expecting path should be "/query/errorLogs".

Answer 1

try this :

(%{URIPROTO}://%{URIHOST}(?<first_path>/[^/]+)%{GREEDYDATA:path})

result:

port    8080
first_path  /abc2
path    /query/errorLogs