# Create visualize - total hit website

**URL:** <https://discuss.elastic.co/t/create-visualize-total-hit-website/102433>\
**Category:** Kibana\
**Created:** [October 2, 2017, 11:57am UTC](https://discuss.elastic.co/t/create-visualize-total-hit-website/102433 "2017-10-02T11:57:52Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![frumat\_l](https://avatars.discourse-cdn.com/v4/letter/f/3ab097/32.png) [@frumat\_l](https://discuss.elastic.co/u/frumat_l)\
**Post date:** [October 2, 2017, 11:57am UTC](https://discuss.elastic.co/t/create-visualize-total-hit-website/102433/1 "2017-10-02T11:57:52Z")

</div>

Hi,

I'm new with this.  
I parsing IIS log with few websites in it.  
one of the filed is URL  
I want to produce chart bar or pie or data table the give me total hit by URL but the root URL, what I succeed to to is pie chart that give me for example 5 top URL's but it give me the all path of the URL.  
for example:  
web site: [http://abc.com](http://abc.com), in the data I get all path "[http://abc.com/home.aspx](http://abc.com/home.aspx)" and so on.  
I need a report he give me root URL.

I will appreciate with this issue.

thanks,  
Lior

---

<div class="post-metadata">

**Author:** ![cjcenizal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cjcenizal/32/11216_2.png) [@cjcenizal](https://discuss.elastic.co/u/cjcenizal)\
**Post date:** [October 3, 2017, 12:58am UTC](https://discuss.elastic.co/t/create-visualize-total-hit-website/102433/2 "2017-10-03T00:58:00Z")

</div>

Hi Lior, here's a thread with a similar problem: [Capture bandwidth of each unique url](https://discuss.elastic.co/t/capture-bandwidth-of-each-unique-url/91310/3). I think the solution that Christian proposes is the best one: extract the URL you want at indexing time (for example, using Logstash's [grok filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html)) and store it as a separate field mapped as a keyword.

Thanks,  
CJ

---

<div class="post-metadata">

**Author:** ![frumat\_l](https://avatars.discourse-cdn.com/v4/letter/f/3ab097/32.png) [@frumat\_l](https://discuss.elastic.co/u/frumat_l)\
**Post date:** [October 3, 2017, 12:07pm UTC](https://discuss.elastic.co/t/create-visualize-total-hit-website/102433/3 "2017-10-03T12:07:46Z")

</div>

Thanks,

I used this to get the root:  
grok {  
match =\> ["URL", "%{URIPROTO:uri\_proto}://(?:%{USER:user}(?::[^@]\*)?@)?(?:%{URIHOST:uri\_domain})?(?:%{URIPATHPARAM:uri\_param})?" ]  
}

```
grok {
		match => ["uri_param", "%{GREEDYDATA:uri_path}\?%{GREEDYDATA:uri_query}"]
	}

kv {
	source => "uri_query"
	field_split => "&"
	target => "query"
	}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 31, 2017, 12:08pm UTC](https://discuss.elastic.co/t/create-visualize-total-hit-website/102433/4 "2017-10-31T12:08:06Z")

</div>

Closed on October 31, 2017, 12:08pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.