get baseurl for different addresses

laurentiugrama — Wed, 25 Aug 2021 11:33:30 GMT

In my logs I have different url and i need to fins a smart way to get the base_url.

The urls are:

/gw/api/request/assets?AccountId=710534357902&reportDate=2021-08-25 - I want to obtain /gw/api/request/assets
/gw/api/oidc/client/v1 - I want to obtain /gw/api/oidc/client/v1
/gw/api/oidc/client/v1/ - I want to obtain /gw/api/oidc/client/v1
/gw/api/AccountOpenings/423423423-32sdf-34243 - I want to obtain /gw/api/AccountOpenings
/gw/api/AccountOpenings/345645fgh5-54hju-45565- I want to obtain /gw/api/AccountOpenings

Can I use a single regexp to do that ?

Now I use something like this but I don't think that is the right way

| eval a=split(URL,"?")|eval URL=mvindex(a,0) | rex field=URL "(?<base_url>.*AccountOpenings/v[0-9]).*" | eval URL=if(match(URL,"AccountOpenings" ),base_url,URL)

Re: get baseurl for different addresses

ITWhisperer — Wed, 25 Aug 2021 11:44:12 GMT

Try something like this

| rex field=URL "(?<base_url>.+(\/v[0-9]|AccountOpenings|(?=\?)))"

Re: get baseurl for different addresses

laurentiugrama — Fri, 27 Aug 2021 10:06:31 GMT

Thank you for the solution. It helps me a lot.

It seems that that the url ended in "/" it's not treated but I will try to find a solution

topic get baseurl for different addresses in Getting Data In

get baseurl for different addresses

Re: get baseurl for different addresses

Re: get baseurl for different addresses