Filter unique value fron url field

I want to filer all unique device id from url message , is it possible?? please help

url: "/v1/default/hls-ts-fk/vodm/f452aa15-87ca-5013-856e-b0758db7c3d5/default_ott.m3u8?PID=testing.30d&PAID=TITL0000000000391111&deviceIdType=test&deviceId=379a1232c7ade1b5fa4f5cbb662f7ee8&appId=com.testing.testing&appName=testing%20Go&devModel=ios_phone&sessionId=abr-vod-2e325654-dd3b-4596-8e8c-a7d8d866ab87&optin=true&externalPackageId=PACK00000000003911111&parentalRating=10&hhid=92a0449ce4e76aa6ef99a06d4a946f25&daiEnabled=true"

Hi
Could you provide come context, where you want to filter it, and with filtering do you mean you want to filter in our out those values? our do you mean you want to create e.h. a table showing you all unique values of deviceId ? For all cases you should extract this field value to it's own keyword typed field so you could use it for aggregations in Elasticsearch

Best,
Matthias

1 Like

want to filter all deviceId=379a1232c7ade1b5fa4f5cbb662f7ee8

Ok, thx what's the mapping of your message field?

Url Field

I mean the mapping in Elasticsearch, here's an overview about that: