get baseurl for different addresses

[laurentiugrama]

In my logs I have different url and i need to fins a smart way to get the base_url.

The urls are:

• /gw/api/request/assets?AccountId=710534357902&reportDate=2021-08-25     - I want to obtain  /gw/api/request/assets
• /gw/api/oidc/client/v1     - I want to obtain  /gw/api/oidc/client/v1
• /gw/api/oidc/client/v1/     - I want to obtain  /gw/api/oidc/client/v1
• /gw/api/AccountOpenings/423423423-32sdf-34243    - I want to obtain /gw/api/AccountOpenings
• /gw/api/AccountOpenings/345645fgh5-54hju-45565- I want to obtain /gw/api/AccountOpenings

Can I use a single regexp to do that ?

Now I use something like this but I don't think that is the right way

| eval a=split(URL,"?")|eval URL=mvindex(a,0)
| rex field=URL "(?<base_url>.*AccountOpenings/v[0-9]).*"
| eval URL=if(match(URL,"AccountOpenings" ),base_url,URL)

[ITWhisperer · Accepted solution]

Try something like this

| rex field=URL "(?<base_url>.+(\/v[0-9]|AccountOpenings|(?=\?)))"

[laurentiugrama]

Thank you for the solution. It helps me a lot.

It seems that that the url ended in "/" it's not treated but I will try to find a solution