Create visualize - total hit website

[frumat_l (Lior)]

Hi,

I'm new with this.
I parsing IIS log with few websites in it.
one of the filed is URL
I want to produce chart bar or pie or data table the give me total hit by URL but the root URL, what I succeed to to is pie chart that give me for example 5 top URL's but it give me the all path of the URL.
for example:
web site: http://abc.com, in the data I get all path "http://abc.com/home.aspx" and so on.
I need a report he give me root URL.

I will appreciate with this issue.

thanks,
Lior

[cjcenizal]

Hi Lior, here's a thread with a similar problem: Capture bandwidth of each unique url. I think the solution that Christian proposes is the best one: extract the URL you want at indexing time (for example, using Logstash's grok filter) and store it as a separate field mapped as a keyword.

Thanks,
CJ

[frumat_l (Lior)]

Thanks,

I used this to get the root:
grok {
match => [ "URL", "%{URIPROTO:uri_proto}://(?:%{USER:user}(?::[^@]*)?@)?(?:%{URIHOST:uri_domain})?(?:%{URIPATHPARAM:uri_param})?" ]
}

grok {
		match => [ "uri_param", "%{GREEDYDATA:uri_path}\?%{GREEDYDATA:uri_query}" ]
	}

kv {
	source => "uri_query"
	field_split => "&"
	target => "query"
	}