# Capture bandwidth of each unique url **URL:** \ **Category:** Kibana\ **Created:** [June 29, 2017, 3:09pm UTC](https://discuss.elastic.co/t/capture-bandwidth-of-each-unique-url/91310 "2017-06-29T15:09:52Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Allan\_John](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/allan_john/32/64362_2.png) [@Allan\_John](https://discuss.elastic.co/u/Allan_John)\ **Post date:** [June 29, 2017, 3:09pm UTC](https://discuss.elastic.co/t/capture-bandwidth-of-each-unique-url/91310/1 "2017-06-29T15:09:52Z")
Hi, I have some urls that come in this format in elastic search: 192.168.1.1/livestream/test/media.m3u8 192.168.1.1/livestream/test/media\_aqbcd00100.ts 192.168.1.1/livestream/test/media\_aqbcd00101.ts 192.168.1.1/livestream/test/media\_aqbcd00102.ts 192.168.1.1/livestream/test/media\_aqbcd00103.ts 192.168.1.1/livestream/test/media\_aqbcd00104.ts I need to extract the urls in such a way that I need to make it unique. For example I need to get like this: 192.168.1.1/livestream/test The purpose is to calculate the total bandwidth transferred from the server, for each unique url. So in this case i can calculate the total bandwidth transferred for "test" consumed by various IP's and the bandwidth consued by each url , in this case : "192.168.1.1/livestream/test" Is it possible in Scripted language in Kibana? Thanks, ---
**Author:** ![cjcenizal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cjcenizal/32/11216_2.png) [@cjcenizal](https://discuss.elastic.co/u/cjcenizal)\ **Post date:** [July 3, 2017, 6:01pm UTC](https://discuss.elastic.co/t/capture-bandwidth-of-each-unique-url/91310/2 "2017-07-03T18:01:37Z")
Hi Allan, Yes, I think you can use scripted fields to do what you're trying to do. You should be able to create a scripted field that extracts a substring from your URL string. Then you can create a Terms bucket aggregation on that scripted field, and configure your metric aggregation to sum your bandwidth field. For example, you could create a scripted field called `baseUrl` that does this: ```auto def text = doc['url'].value; int firstIndex = text.lastIndexOf('/'); int lastIndex = text.length(); return text.substring(firstIndex, lastIndex); ``` This scripted field will return a value of "192.168.1.1/livestream/test/" for the example URLs you shared. Then, assuming your bandwidth is represented by a field called `bytes`, you'd configure your visualization like this: ![](https://us1.discourse-cdn.com/elastic/original/3X/c/9/c9691d6f5f70bdff3650a575bb4a9a9ea9ffa9f2.png) This will show you a visualization of the top 5 baseUrls which consume the most bandwidth. Please let me know if this helps! Thanks, CJ ---
**Author:** ![cjcenizal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cjcenizal/32/11216_2.png) [@cjcenizal](https://discuss.elastic.co/u/cjcenizal)\ **Post date:** [July 3, 2017, 6:02pm UTC](https://discuss.elastic.co/t/capture-bandwidth-of-each-unique-url/91310/3 "2017-07-03T18:02:47Z")
BTW, here's the documentation of other methods you can use to manipulate String fields: [https://docs.oracle.com/javase/7/docs/api/java/lang/String.html](https://docs.oracle.com/javase/7/docs/api/java/lang/String.html). Might come in handy if you want to try something else other than `lastIndexOf` and `substring`. CJ ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 3, 2017, 6:08pm UTC](https://discuss.elastic.co/t/capture-bandwidth-of-each-unique-url/91310/4 "2017-07-03T18:08:43Z")
Even though it appears possible to do this using scripted fields in Kibana, the most efficient and scalable way to do this would probably be to instead extract the url you want to aggregate on at indexing time and store it in a separate field mapped as a keyword. ---
**Author:** ![Allan\_John](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/allan_john/32/64362_2.png) [@Allan\_John](https://discuss.elastic.co/u/Allan_John)\ **Post date:** [July 4, 2017, 1:21am UTC](https://discuss.elastic.co/t/capture-bandwidth-of-each-unique-url/91310/5 "2017-07-04T01:21:14Z")
Hi CJ, Thanks for the reply. What if I need to extract the text "test" alone. Getting the lastIndexOf the output in the above command will work? Thanks, ---
**Author:** ![cjcenizal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cjcenizal/32/11216_2.png) [@cjcenizal](https://discuss.elastic.co/u/cjcenizal)\ **Post date:** [July 4, 2017, 3:35am UTC](https://discuss.elastic.co/t/capture-bandwidth-of-each-unique-url/91310/6 "2017-07-04T03:35:11Z")
Hi Allan, have you taken a look at the docs I linked to? You can pass additionally arguments to `lastIndexOf` to "walk" backwards from one slash to the slash preceding it. Then you can continue to pass these indices to `substring` to extract out the different parts of the URL. Though you might want to consider Christian's suggestion if you're planning on building a long-term (i.e. scalable) solution. Thanks, CJ ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 1, 2017, 3:35am UTC](https://discuss.elastic.co/t/capture-bandwidth-of-each-unique-url/91310/7 "2017-08-01T03:35:37Z")
Closed on August 1, 2017, 3:35am UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.