# How to parse dynamic REST endpoint and create one constant endpoint for them

**URL:** <https://discuss.elastic.co/t/how-to-parse-dynamic-rest-endpoint-and-create-one-constant-endpoint-for-them/181511>\
**Category:** Logstash\
**Created:** [May 17, 2019, 5:24am UTC](https://discuss.elastic.co/t/how-to-parse-dynamic-rest-endpoint-and-create-one-constant-endpoint-for-them/181511 "2019-05-17T05:24:07Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Arjun\_Dandagi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arjun_dandagi/32/46357_2.png) [@Arjun\_Dandagi](https://discuss.elastic.co/u/Arjun_Dandagi)\
**Post date:** [May 17, 2019, 5:24am UTC](https://discuss.elastic.co/t/how-to-parse-dynamic-rest-endpoint-and-create-one-constant-endpoint-for-them/181511/1 "2019-05-17T05:24:07Z")

</div>

So, I am trying to parse the dynamically incoming rest API calls to make them look one constant to view them in kibana  
so currently i am using GSUB to match the string and replace them using a constant value,  
I mean for example if the dynamic endpoints are like  
`/v2/employees/45/salarymonth/1/something`  
here the numbers are dynamic  
i am using `gsub ["raw_request" ,"/employees/\d+/","/employees/<employee_id>","raw_request" ,"/salarymonth/\d+/","/salarymonth/<month_id>"]`

there are many such kind , and salarymonth endpoint may or may not be there

but I want to know if there is any way I can match this URL endpoint. we have almost 10 application with many endpoints, I can't do gsub itself for each application (that's a tedious task )  
so what I want to do is, match and replace them to one value

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 17, 2019, 12:22pm UTC](https://discuss.elastic.co/t/how-to-parse-dynamic-rest-endpoint-and-create-one-constant-endpoint-for-them/181511/2 "2019-05-17T12:22:30Z")

</div>

How about this?...

```
mutate { gsub => ["message", "/([a-z]+)/\d+", "/\1/<\1_id>" ] }

```

That would give you

```
   "message" => "/v2/employees/<employees_id>/salarymonth/<salarymonth_id>/something",
```

---

<div class="post-metadata">

**Author:** ![Arjun\_Dandagi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arjun_dandagi/32/46357_2.png) [@Arjun\_Dandagi](https://discuss.elastic.co/u/Arjun_Dandagi)\
**Post date:** [May 20, 2019, 5:53am UTC](https://discuss.elastic.co/t/how-to-parse-dynamic-rest-endpoint-and-create-one-constant-endpoint-for-them/181511/3 "2019-05-20T05:53:06Z")

</div>

thanks @badger , the solution i was looking for was to search for alternative to map endpoints and change those values , the TRANSLATE filter plugin was what i was looking for

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 17, 2019, 5:53am UTC](https://discuss.elastic.co/t/how-to-parse-dynamic-rest-endpoint-and-create-one-constant-endpoint-for-them/181511/4 "2019-06-17T05:53:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.