# Can we have a regex to only get 2 or 3 level deep urls from a nginx logs, before passing them on

**URL:** <https://discuss.elastic.co/t/can-we-have-a-regex-to-only-get-2-or-3-level-deep-urls-from-a-nginx-logs-before-passing-them-on/116310>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 19, 2018, 10:15pm UTC](https://discuss.elastic.co/t/can-we-have-a-regex-to-only-get-2-or-3-level-deep-urls-from-a-nginx-logs-before-passing-them-on/116310 "2018-01-19T22:15:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![gokhalep](https://avatars.discourse-cdn.com/v4/letter/g/5f8ce5/32.png) [@gokhalep](https://discuss.elastic.co/u/gokhalep)\
**Post date:** [January 19, 2018, 10:15pm UTC](https://discuss.elastic.co/t/can-we-have-a-regex-to-only-get-2-or-3-level-deep-urls-from-a-nginx-logs-before-passing-them-on/116310/1 "2018-01-19T22:15:56Z")

</div>

I am using filebeat to get the nginx logs and pass them to the "wavefront" Now the log line in nginx looks like this:

- - [09/Jan/2018:09:16:07 +0000] "GET /abc/def/ghi/jkl/mnop? HTTP/1.1" 200 4471 "http://:8000" "ServiceHost/xxx" 0.035 0.035 .  
Is there a way in the filebeat.yaml prospectors to read this logline but only send the the url 2 or 3 levels deep. So I only want to send /abc/def/ghi and not the whole to the wavefront.

Thanks,

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 20, 2018, 3:06am UTC](https://discuss.elastic.co/t/can-we-have-a-regex-to-only-get-2-or-3-level-deep-urls-from-a-nginx-logs-before-passing-them-on/116310/2 "2018-01-20T03:06:50Z")

</div>

This looks related to [How to define custom grock to get only 3 levels deep url](https://discuss.elastic.co/t/how-to-define-custom-grock-to-get-only-3-levels-deep-url/116317)

Given you need to do this with grok I will close this one. In future it'd be great if you can just ask in one place 🙂

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 20, 2018, 3:06am UTC](https://discuss.elastic.co/t/can-we-have-a-regex-to-only-get-2-or-3-level-deep-urls-from-a-nginx-logs-before-passing-them-on/116310/3 "2018-01-20T03:06:53Z")

</div>