logstash grok uri. Find URL or URI in field data.

logstash-grok-uri.txt

# %{URI:uri}
#
# %{URIPROTO:uriproto}://(?:%{USER:user}(?::[^@]*)?@)?(?:%{URIHOST:urihost})?(?:%{URIPATHPARAM:uripathparam})?
#
# %{EMAILLOCALPART:emaillocalpart}@%{HOSTNAME:emailhostname}
#
# %{EMAILADDRESS:emailaddress}

### URI / URL

     grok {
        match => { "message" => "%{URI:uri}" }
        }

if [uri] {
     grok {
       match => { "uri" => "%{URIPROTO:uriproto}://(?:%{USER:user}(?::[^@]*)?@)?(?:%{URIHOST:urihost})?(?:%{URIPATHPARAM:uripathparam})?" }
	   add_tag => [ "uri_exist_email" ]
        }
    }

### Email ###

     grok {
        match => { "message" => "%{EMAILADDRESS:emailaddress}" }
        }

if [uri] {
     grok {
       match => { "emailaddress" => "%{EMAILLOCALPART:emaillocalpart}@%{HOSTNAME:emailhostname}" }
	   add_tag => [ "exist_email" ]
        }
    }