I want to get the \"GET\" queries from my server logs.
For example, this is the server log
1.0.0.127.in-addr.arpa - - [10/Jun/2012
It's often easier to use a pipeline rather than a single complex regular expression. This works on the data you provided:
fgrep GET /tmp/foo |
egrep -o 'GET (.*) HTTP' |
sed -r 's/^GET \/(.+) HTTP/\1/'
This pipeline returns the following results:
hello
ss
There are certainly other ways to get the job done, but this patently works on the provided corpus.