Regular Expression for retrieving File Extension in HTTP url

Question

I am working on the ELK stack and as part of Logstash data transformation i am transforming data in Apache access logs.

One of the metric needed is to get a stat on different content types (aspx, php, gif, etc.).

From the log file I am trying to retrieve request url and then deduce the file type, for ex /c/dataservices/online.jsp?callBack is the request and I would get .aspx using the regular expression \.\w{3,4}.

My regular expression wont work for request say /etc/designs/design/libs.min.1253.css this is returning me .min as the extension.

I am trying to get the last extension but it is not working. Please do suggest other approaches.

brandonscript · Accepted Answer · 2015-07-21 14:35:53Z

11

You need to anchor the match to the end of the string or the beginning of a query param ?. Try:

\.\w{3,4}($|\?)

Play with it here: https://regex101.com/r/iV3iM1/1

edited Jul 21, 2015 at 14:35

answered Jul 17, 2015 at 17:13

brandonscript

73.7k35 gold badges178 silver badges240 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Spider Over a year ago

(\.\w{3,4})($|\?) get group 1 for ignore '?'

sbrattla Over a year ago

The last ($|\?) produces an empty capture group. You could probably do (?:$|\?) on that one to not capture whatever comes after the extension. Also, to capture only the actual file extension (and not the leading dot) : \.(\w{3,4})(?:$|\?)

brandonscript Over a year ago

Yep, this is a good suggestion.

Ian McLaird · Accepted Answer · 2015-07-17 17:35:50Z

0

You're going to need a much fancier Regex.

Try this one.

([/.\w]+)([.][\w]+)([?][\w./=]+)?

This uses three capture groups. The first ([/.\w]+) matches your path up to the last .

The second ([.][\w]+) matches the final extension, and you can use the capture group to read it out.

The third ([?][\w./=]+)? matches the query string, which is optional.

answered Jul 17, 2015 at 17:35

Ian McLaird

5,5852 gold badges25 silver badges31 bronze badges

2 Comments

Jimmyt1988 Over a year ago

This doesn't work. Just so you're aware - regexr.com/6vl2o

Ian McLaird Over a year ago

The reason this does not work is that the initial capture group is too restrictive. There are many characters allowed in a URL that it would not capture, so this breaks. It worked for the OP's example, but it's easy to make one where it won't. The accepted answer is better.

Collectives™ on Stack Overflow

Regular Expression for retrieving File Extension in HTTP url

2 Answers 2

3 Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related