I need to do an analysis on API calls using logs, like avg, min, max, percentile99, percentil95, percentile99 response time, and also hits per second. So, if I have events like below : /data/users/1443 | 0.5 sec /data/users/2232 | 0.2 sec /data/users/39 | 0.2 sec Expectation: I want them to be grouped like below, as per their API pattern : proxy max_response_time /data/users/{id} | 0.5 sec   These path variables (like {id}) can be numerical or can be a string with special characters I have about 3000 such API patterns which have path variables in them,  they can be categorized into 3 types, those that have a path variable only at the end, those that have 1 or more path variables only in the middle, and those that have 1 or more path variables in the middle as well as in the end. Note: there are no arguments after the API i.e. like /data/view/{name}/pagecount?age=x. There will be just the URI part proxy method request_time /data/users/{id} POST 0.046 /server/healthcheck/check/up GET 0.001 /data/commons/people/multi_upsert POST 0.141 /store/org/manufacturing/multi_read POST 0.363 /data/users/{id}/homepage/{name} POST 0.084 /data/view/{name}/pagecount PUT 0.043 Category 1 (path variable only at the end) : /data/users/{id} POST 0.046 Category 2 (1 or more path variables only in the middle) : /data/view/{name}/pagecount PUT 0.043 /data/view/{name}/details/{type}/pagecount PUT 0.043 Category 3 (1 or more path variables only in the middle and also at the end) : /data/users/{id}/homepage/{name} POST 0.084 /data/users/{id}/homepage/{type}/details/{name} POST 0.084   Current Query :     index="*myindex*" host="*abc*" host!=*ftp* sourcetype!=infra* sourcetype!=linux* sourcetype = "nginx:plus:access" | bucket span=1s _time| stats count by env,tenant,uri_path,request_method,_time       I need the uri_path to be grouped as per the API patterns I have.    1 option is to add 3000 regex replace statements, like the one blow, in the query for each API pattern, but that makes query too heavy to parse, I tried something like this, for a sample pattern /api/data/users/{id} :   |rex mode=sed field=uri_path "s/\/api\/data\/users\/([^\/]+)$/\/api\/data\/users\/{id}/g"     ... View more