regex for uri ignoring query params and path params.

[donB]

I am trying to find the top api url's that were consumed by our clients. Our uri in logs are of below format.

1. https://api.server.com/user/1                       (type 1)
2. https://api.server.com/user/2                       (type 1)
3. https://api.server.com/user/3/role/1        (type 2)
4 . https://api.server.com/user?name=test  (type 3)

Now i need result count for each uri like below.

/user/{id} - 2

/user/{id}/role{id}. - 1

/user   - 1  (or user {filter} for query params e.g. /user/{filter})

i have unlimited combinations of such path parameters for different resources. what is the best way to get the count of url hits.

[ITWhisperer]

Without the full log entry or an example of the fields already extracted, I will have to guess that the url is either enclosed in double quotes or there is a trailing space of some kind and that the ids are all a series of digits

| rex "(?P<uri>https:\/\/api\.server\.com\/[^\?\"\s]+)"
| rex field=uri mode=sed max_match=0 "s/\/[\d]+/\/\{id\}/"
| stats count by uri