Extracts URL components from a field. The attributes url.scheme, url.username, url.password, url.host, url.port, url.path, url.fragment and url.query are added to the event.

ParameterTypeRequiredDefault ValueDescription
asstringoptional[a]   Use a prefix for the attributes added to the event.
field[b]stringoptional[a] url The field from which to parse URL components.

[a] Optional parameters use their default value unless explicitly set.

[b] The parameter name field can be omitted.

Hide omitted argument names for this function

Show omitted argument names for this function

The parseUrl() uses the Java java.net.URI to parse and extract the URL components. See URI for more information on the parsing and extraction of URI elements.

Due to the way the parsing works, it is possible that the parser will mis-identify elements of a URL if the URL is only partial. The class by default looks for the URL scheme first (for example, the portion of a string before the first colon). This can mean that the URLs that are not fully qualified are misidentified. For example, consider the URL:

HTML
site.example.com:80/path/to/examp

Parsing will identify site.example.com as url.scheme. Care should be taken to ensure that a fully-qualified URL is supplied to ensure correct parsing of the components. See the Java URI page for more information on how the individiaul elements are parsed.

parseUrl() Examples

Within the humio repository, parsing the uri field to aggregate the list of paths used:

logscale
parseUrl(uri)
| groupBy(uri.path)

Creates the corresponding URI fields which are aggregated and result in output similar to this:

uri_count
/graphql132
/api/v1/refresh95
/api/v1/repositories/humio/queryjobs30
/api/v1/repositories/humio/queryjobs/P29-vxBwkHK6nxeDuC4CzOOmc0Oq3
/api/v1/repositories/humio/queryjobs/P7-mHpupr5riWe5XEoRnY8VhicU2
/api/v1/repositories/humio/queryjobs/P7-eaRjXUkTzse6fB3M6kQcbh4m2
/api/v1/repositories/humio/queryjobs/P7-WjVRVoJWmdh9REgpuoGHyoOC2
/api/v1/repositories/humio/queryjobs/P7-VadNjnjvQaeXcfJRhfRb5Uuv2
/api/v1/repositories/humio/queryjobs/P7-GlsGrU405DmI2PPeL33PwT9n2
/api/v1/repositories/humio/queryjobs/P7-Bwg99bEHk6NeBmSU1fSZG0Fa2
/api/v1/repositories/humio/queryjobs/P6-6VusohlK49WisjAYttFIbpfm2

Parses the field named endpoint and adds URL components to the event.

logscale
parseUrl(field=endpoint)

Parses the field named endpoint and adds URL components to the event with the field url as a prefix, for example url.path, url.scheme etc.

logscale
url := parseUrl(field=endpoint)

Parses the field named endpoint and adds URL components to the event with apiEndpoint as a prefix, for example apiEndpoint.path, apiEndpoint.scheme etc.

logscale
parseUrl(field=endpoint, as=apiEndpoint)