Here is the query | rex field=_raw "(?ms)^[^\"\\n]*\"(?P<http_method>\\w+)\\s+((?P<path>/[a-zA-Z0-9-_/=]*).*) (?P<http_ver>[^\"]+)\"\\s+(?P<status_code>\\d+)" offset_field=_extracted_fields_bounds | rex field=_raw "(?ms)^[^\"\\n]*\"(?P<http_method>\\w+)\\s+((?P<path>/imgproxy/*).*) (?P<http_ver>[^\"]+)\"\\s+(?P<status_code>\\d+)" offset_field=_extracted_fields_bounds | eval endpoint=http_method." ".path | where like(path, "/info%") OR like(path, "/status%") OR like(path, "/imgproxy%") OR like(path, "/error%") OR like(path, "/rest/suite/%") | chart count over endpoint by status_code usenull=false
... View more