How to split URL in kibana

Elastic Stack Kibana
1

Hello

Is it possible to parse URL, keep the first argument and graph it.
For example, i have some datas like this :
site1/page1.html
site1/page2.html
site1/dir/index.html
site2/index.php
site3/index.php

i want visualise only the number of site1, site2, site3, ...

does it possible?

Regards
Florent

2

If this is something you'll need frequently I would suggest splitting this out into its own field before ingesting into elasticsearch, using something like logstash.

If not, you can use a scripted field. The scripting language painless is available in 5.0+ and a script for this would look something like:

Pasted image1556×538 28 KB

Other scripting languages are available in previous versions but working with strings is disabled by default. https://www.elastic.co/guide/en/elasticsearch/reference/2.4/modules-scripting.html has more info on why, and how to enable them.

3

Great, i will try this method

And yes, it's just need this one time

Thanks

4

There is now a new blog post on using Painless scripting in Kibana scripted fields with examples and best practices: https://www.elastic.co/blog/using-painless-kibana-scripted-fields