Count by regex pattern

[Alexkl (Alexandre Klein)]

I am struggling with a pie chart visualisation in kibana (5.2.2) I have a field url wich contains things like :

https://fhfhf.jffjr.com/ping?toto=tata
https://fhfhf.jffjr.com/user=tu
https://fhfhf.jffjr.com/ping?tutu=tata
I want to get in a pie chart the count of url fields containing the pattern .ping. vs others.

I didn't find a way to do it. It's sliced by the full keyword. Is there a way to do it without scripting ?

Thanks !

[spalger (Spencer Alger)]

If you are trying to avoid scripting then I imagine you are worried about the performance of this query. If so, then regular expressions probably aren't going to be the best, but you can do this with a regex in the "filters" aggregation.

See https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html#_regular_expressions

If regexp is still too slow, I suggest pre-processing the logs with something like logstash to extract the bit of data you are trying to understand (maybe the path of the url?)

[Alexkl (Alexandre Klein)]

Hello,

You are right i was afraid of the performance of the query with a script and i wished to avoid adding a logstash filter.
I will try with the filter and if it didn't work i will make some tests with scripting.

Thanks !
Alex