title: Regex to correctly parse url from nginx logs
body: <p>I'm using fluentd to pipe nginx logs to elasticsearch using the tail plugin. A regex is provided for parsing out the fields:</p>
  
  <pre><code>^(?&lt;remote&gt;[^ ]*) (?&lt;host&gt;[^ ]*) (?&lt;user&gt;[^ ]*) \[(?&lt;time&gt;[^\]]*)\] "(?&lt;method&gt;\S+)(?: +(?&lt;path&gt;[^\"]*) +\S*)?" (?&lt;code&gt;[^ ]*) (?&lt;size&gt;[^ ]*)(?: "(?&lt;referer&gt;[^\"]*)" "(?&lt;agent&gt;[^\"]*)")?$
  </code></pre>
  
  <p>I've attempted to modify this to further sub divide the path into service and endpoint fields. Service is simply the first part of the url while endpoint is everything up to the start of the query parameters or the inclusion of an explicit id. This is what I've come up with:</p>
  
  <pre><code>^(?&lt;remote&gt;[^ ]*) (?&lt;host&gt;[^ ]*) (?&lt;user&gt;[^ ]*) \[(?&lt;time&gt;[^\]]*)\] "(?&lt;method&gt;\S+)(?: +(?&lt;path&gt;\/(?&lt;endpoint&gt;(?&lt;service&gt;[^?\/]*)[^?\d]*)[^\"]*) +\S*)?" (?&lt;code&gt;[^ ]*) (?&lt;size&gt;[^ ]*)(?: "(?&lt;referer&gt;[^\"]*)" "(?&lt;agent&gt;[^\"]*)")?$
  </code></pre>
  
  <p>For the most part this works fine. For example, running against the following url produces a service field of <code>service1</code> and an endpoint of <code>service1/hello/</code></p>
  
  <pre><code>127.0.0.1 - - [10/Aug/2016:10:32:13 +0000] "OPTIONS /service1/hello/6/ HTTP/1.1" 204 0 "http://hello.hello.com" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36"
  </code></pre>
  
  <p>However, this also matches when the number is not preceded by a forward slash. A url of: <code>/service1/hel123lo/6/</code> would result in an endpoint field of <code>service1/hel</code></p>
  
  <p>How can I match on a digit preceded by a forward slash only?</p>