Extracts URL components from a field. The attributes url.scheme, url.username, url.password, url.host, url.port, url.path, url.fragment and url.query are added to the event.

Function Traits: Transformation

ParameterTypeRequiredDefaultDescription
asstringoptional  Use a prefix for the attributes added to the event.
field[a]stringoptionalurl The field from which to parse URL components.

[a] The argument name field can be omitted.

The parameter name for field can be omitted; the following forms are equivalent:

logscale
parseUrl("url")

and:

logscale
parseUrl(field="url")

The parseUrl() uses the Java java.net.URI to parse and extract the URL components. See URI for more information on the parsing and extraction of URI elements.

Due to the way the parsing works, it is possible that the parser will mis-identify elements of a URL if the URL is only partial. The class by default looks for the URL scheme first (i.e. the portion of a string before the first colon). This can mean that the URLs that are not fully qualified are misidentified. For example, consider the URL:

HTML
site.example.com:80/path/to/examp

Parsing will identify site.example.com as url.scheme. Care should be taken to ensure that a fully-qualified URL is supplied to ensure correct parsing of the components. See the Java URI page for more information on how the individiaul elements are parsed.

parseUrl() Examples

Within the humio repository, parsing the uri field to aggregate the list of paths used:

logscale
parseUrl(uri)
| groupBy(uri.path)

Creates the corresponding URI fields which are aggregated and result in output similar to this: 

/graphql                                                           132
/api/v1/refresh                                                     95
/api/v1/repositories/humio/queryjobs                                30
/api/v1/repositories/humio/queryjobs/P29-vxBwkHK6nxeDuC4CzOOmc0Oq    3
/api/v1/repositories/humio/queryjobs/P7-mHpupr5riWe5XEoRnY8VhicU     2
/api/v1/repositories/humio/queryjobs/P7-eaRjXUkTzse6fB3M6kQcbh4m     2
/api/v1/repositories/humio/queryjobs/P7-WjVRVoJWmdh9REgpuoGHyoOC     2
/api/v1/repositories/humio/queryjobs/P7-VadNjnjvQaeXcfJRhfRb5Uuv     2
/api/v1/repositories/humio/queryjobs/P7-GlsGrU405DmI2PPeL33PwT9n     2
/api/v1/repositories/humio/queryjobs/P7-Bwg99bEHk6NeBmSU1fSZG0Fa     2
/api/v1/repositories/humio/queryjobs/P6-6VusohlK49WisjAYttFIbpfm     2
...

Parses the field named endpoint and adds URL components to the event.

logscale
parseUrl(field=endpoint)

Parses the field named endpoint and adds URL components to the event with the field url as a prefix, for example url.path, url.scheme etc.

logscale
url := parseUrl(field=endpoint)

Parses the field named endpoint and adds URL components to the event with apiEndpoint as a prefix, for example apiEndpoint.path, apiEndpoint.scheme etc.

logscale
parseUrl(field=endpoint, as=apiEndpoint)