 <p>Easiest solution is</p> <pre><code>/%{DATA:col1}/%{DATA:col2}/%{DATA:index}/%{DATA:server}\.%{GREEDYDATA:end} </code></pre> <p>you can remove the names <code>col1</code>, <code>col2</code>, and <code>end</code> to drop those captures.</p> <p>This pattern relies on there always being the same number of parts in your URI. If there are a variable number you could use something like this.</p> <pre><code>(?:/%{USER})*/%{DATA:index}/%{DATA:server}\.%{GREEDYDATA:end} </code></pre> <p>I made and tested these using <a href="http://grokconstructor.appspot.com/do/match" rel="nofollow">the grok constructor</a></p> <hr> <p>Using this pattern:</p> <pre><code>filter { grok { match =&gt; { "message" =&gt; &lt;message-pattern&gt; } } grok { match =&gt; { "log_path" =&gt; "(?:/%{USER})*/%{DATA:index}/%{DATA:server}\.%{GREEDYDATA}" } } } </code></pre> <p>Where <code>"log_path"</code> is the name of the field containing the log path after you do your normal message parsing.</p>