In my source, cache22 is always the third occurence and the string keeps changing to different values like "cache22" or "hotels" or "rental" etc..but it is always after "/apps/home"
That's quite easy. The expression
will capture the third path component (one or more characters except slash) into the
The other thing is there might or might not be a subdirectory after "/logs" in the source... My scenario is like I am streaming log files(.log) under "/logs" and in some of the applications there are additional (.log) inside subdirectories under "/logs" and these subdirectory names keep changine.
I don't follow exactly, but
whatever just like above, followed by "logs/", and then it captures the rest of the string. I'll leave any final adjustments as an exercise.
Please take note that none of the requirements in your second post was present in your original post.