Replace random string in a field

[pjtbasu]

Hi team,

I've 1 field named - 'URI' coming in micro service log dump.

Example Values of URI field is like below -

/mobile/login
/desktop/login
/account/100123445/details
/account/100123999/details
/public/account/XYZAASWDDSSSS/transactions
/public/account/XYZQWERTS/transactions

Now I'm just trying to see successful or failure transactions list sorted by the URI.

My example query -
index=mslogs "successful"|stats count by URI

Now the problem is, the result is coming as -
URI Count
/mobile/login 50
/desktop/login 50
/account/100123445/details 1
/account/100123999/details 1
/public/account/XYZAASWDDSSSS/transactions 1
/public/account/XYZQWERTS/transactions 1

Obviously, I need this to show like -

/mobile/login 50
/desktop/login 50
/account//details 2
/public/account//transactions 2

Basically I want to remove the random string part in the 'URI' field. Different URI has different random parts and those random parts are present differently in the URI. I'm willing to write regex to handle all the scenario in URI, but I want to replace them with '*' so that if I do a 'stats' or timechart, single URI.

Please suggest.

[jacobpevans]

Greetings @pjtbasu,

As you said, you'll want to regex them out. The beginning of the regex replace command for all of them would be | eval URI = replace(URI,. followed by:

/account/#####/details = "(/account)/[^/]+(/details)", "\1\2")
/public/account/#####/transactions = "(/public/account)/[^/]+(/transactions)", "\1\2")

Here's a run-anywhere search for your sample data:

| makeresults
| eval URI="/account/100123445/details"
| append [ | makeresults | eval URI="/public/account/XYZAASWDDSSSS/transactions" ]
| eval URI = replace(URI, "(/account)/[^/]+(/details)",             "\1\2")
| eval URI = replace(URI, "(/public/account)/[^/]+(/transactions)", "\1\2")