Create visualize - total hit website


I'm new with this.
I parsing IIS log with few websites in it.
one of the filed is URL
I want to produce chart bar or pie or data table the give me total hit by URL but the root URL, what I succeed to to is pie chart that give me for example 5 top URL's but it give me the all path of the URL.
for example:
web site:, in the data I get all path "" and so on.
I need a report he give me root URL.

I will appreciate with this issue.


Hi Lior, here's a thread with a similar problem: Capture bandwidth of each unique url. I think the solution that Christian proposes is the best one: extract the URL you want at indexing time (for example, using Logstash's grok filter) and store it as a separate field mapped as a keyword.



I used this to get the root:
grok {
match => [ "URL", "%{URIPROTO:uri_proto}://(?:%{USER:user}(?::[^@]*)?@)?(?:%{URIHOST:uri_domain})?(?:%{URIPATHPARAM:uri_param})?" ]

grok {
		match => [ "uri_param", "%{GREEDYDATA:uri_path}\?%{GREEDYDATA:uri_query}" ]

kv {
	source => "uri_query"
	field_split => "&"
	target => "query"

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.