Extracts URL components from a field. The attributes
url.scheme
,
url.username
,
url.password
,
url.host
,
url.port
,
url.path
,
url.fragment
and
url.query
are added to the event.
Hide omitted argument names for this function
Omitted Argument NamesThe argument name for
field
can be omitted; the following forms of this function are equivalent:logscaleparseUrl("field")
and:
logscaleparseUrl(field="field")
These examples show basic structure only.
The parseUrl()
uses the Java
java.net.URI
to parse and extract the URL
components. See
URI
for more information on the parsing and extraction of URI elements.
Due to the way the parsing works, it is possible that the parser will mis-identify elements of a URL if the URL is only partial. The class by default looks for the URL scheme first (for example, the portion of a string before the first colon). This can mean that the URLs that are not fully qualified are misidentified. For example, consider the URL:
site.example.com:80/path/to/examp
Parsing will identify site.example.com
as
url.scheme. Care should be taken to ensure that a
fully-qualified URL is supplied to ensure correct parsing of the
components. See the Java
URI
page for more information on how the individiaul elements are parsed.
parseUrl()
Examples
Within the humio repository, parsing the uri field to aggregate the list of paths used:
parseUrl(uri)
| groupBy(uri.path)
Creates the corresponding URI fields which are aggregated and result in output similar to this:
uri | _count |
---|---|
/graphql | 132 |
/api/v1/refresh | 95 |
/api/v1/repositories/humio/queryjobs | 30 |
/api/v1/repositories/humio/queryjobs/P29-vxBwkHK6nxeDuC4CzOOmc0Oq | 3 |
/api/v1/repositories/humio/queryjobs/P7-mHpupr5riWe5XEoRnY8VhicU | 2 |
/api/v1/repositories/humio/queryjobs/P7-eaRjXUkTzse6fB3M6kQcbh4m | 2 |
/api/v1/repositories/humio/queryjobs/P7-WjVRVoJWmdh9REgpuoGHyoOC | 2 |
/api/v1/repositories/humio/queryjobs/P7-VadNjnjvQaeXcfJRhfRb5Uuv | 2 |
/api/v1/repositories/humio/queryjobs/P7-GlsGrU405DmI2PPeL33PwT9n | 2 |
/api/v1/repositories/humio/queryjobs/P7-Bwg99bEHk6NeBmSU1fSZG0Fa | 2 |
/api/v1/repositories/humio/queryjobs/P6-6VusohlK49WisjAYttFIbpfm | 2 |
Parses the field named endpoint and adds URL components to the event.
parseUrl(field=endpoint)
Parses the field named endpoint and adds URL components to the event with the field url as a prefix, for example url.path, url.scheme etc.
url := parseUrl(field=endpoint)
Parses the field named endpoint and adds URL components to the event with apiEndpoint as a prefix, for example apiEndpoint.path, apiEndpoint.scheme etc.
parseUrl(field=endpoint, as=apiEndpoint)