URL-encodes the contents of a string field.
Hide omitted argument names for this function
Omitted Argument NamesThe argument name for
field
can be omitted; the following forms of this function are equivalent:logscale SyntaxurlEncode("value")
and:
logscale SyntaxurlEncode(field="value")
These examples show basic structure only.
urlEncode()
Syntax Examples
With an event with a field
Bar=https://www.example.com,
you get
https%3A%2F%2Fwww.example.com
in
the _urlencode field
urlEncode("Bar")
With an event with a field
Bar=https://www.example.com,
you get
https%3A%2F%2Fwww.example.com
in
the Foo field
Foo:=urlEncode("Bar")
With an event with a field
Bar=https://www.example.com,
you get
https%3A%2F%2Fwww.example.com
in
the Foo field
urlEncode("Bar", as="Foo")
urlEncode()
Examples
Click
next to an example below to get the full details.Convert Special Characters and Spaces in HTML Parsed Data
Convert special characters in strings to their percent-encoded
equivalents using the urlEncode()
function
Query
Bar = *
| urlEncode(field=Bar)
Introduction
URL encoding is necessary when processing data passed via HTML forms, as
such data may contain special characters (like /
,
.
, #
) that could, for example,
have special meanings in URLs, be invalid characters for URLs or be
altered during transfer.
In this example, the urlEncode()
function
URL-encodes the content of the input field Bar and
returns the result in the default output field
_urlencode.
Example incoming data might look like this:
@timestamp | Bar | form_id | source |
---|---|---|---|
1683000000000 | https://www.example.com | form_1 | web_submission |
1683000001000 | https://internal.example.com/path#section | form_2 | api_call |
1683000002000 | https://search.example.com/?q=test query | form_3 | search_form |
Step-by-Step
Starting with the source repository events.
- logscale
Bar = *
Filters for events containing the Bar field.
- logscale
| urlEncode(field=Bar)
URL-encodes the content of the input field Bar and returns the result in the default output field _urlencode. Special characters are replaced with their percent-encoded ASCII equivalents.
Event Result set.
Summary and Results
The query is used to convert special characters and spaces in data to their corresponding percent-encoded ASCII characters that, otherwise, could cause issues when being parsed. URL encoding replaces special characters with a percent sign (%) followed by a two-digit hexadecimal code that represents the character.
URL encoding is an important technique for ensuring that URLs can be transmitted and processed correctly, without issues caused by disallowed characters. It is commonly used in web applications, APIs, and other internet-based systems that work with URLs.
Sample output from the incoming example data:
@timestamp | Bar | form_id | source | _urlencode |
---|---|---|---|---|
1683000000000 | https://www.example.com | form_1 | web_submission | https%3A%2F%2Fwww.example.com |
1683000001000 | https://internal.example.com/path#section | form_2 | api_call | https%3A%2F%2Finternal.example.com%2Fpath%23section |
1683000002000 | https://search.example.com/?q=test query | form_3 | search_form | https%3A%2F%2Fsearch.example.com%2F%3Fq%3Dtest%20query |
Alternative ways to specify the output field is to use the assignment
operator (Foo:=urlEncode("Bar")
or the
as
parameter
(urlEncode("Bar", as="Foo")
.