Hi folks. I am not sure how to achieve the visualisation that I need from our web logs.
We have a bunch of URLs being logged, part of which contains a customer-identifying string.
/customerA/whatever.html /customerA/something.html /customerA/whatever.html /customerB/something.html /customerC/whatever.html
I am using a standard analyzer on the field, so I can get charts based on the tokens in there:
whatever.html 3 customerA 3 something.html 2 customerB 2 customerC 1
What I would like to get out is just the customer part as a count, where one of the other tokens is present (e.g. whatever.html)
customerA 2 customerC 1
Or e.g. something.html:
customerA 1 customerB 1
If I query on
requestUrl it looks like it is using the whole field, not the split out parts.
I could work around this if there is a way of adding a field during ingress (these come from FileBeat into Elastic Cloud) based on a regex result, as the customer-identifying part is always matchable, in this example