Configuration of Logstash to remove domain from URL

Elastic Stack Logstash
1

Is it possible to configure Logstash to remove domain name when receiving URL input?

E.g:
image

Picture above as an example, I would like to eliminate everthing behind 'path' to send to Elasticsearch. If it is possible, may I get the idea of the configuration?

2

Using the standard grok patterns as an example, I would try

grok { match => { "yourFieldName" => "%{URIPROTO}://(?:%{USER}(?::[^@]*)?@)?(?:%{URIHOST})?/%{GREEDYDATA:theBitYouWant}" } }
3

Thank you very much! What you suggested is exactly the solution that I was stuck on.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.