Hi, In our logs we have the API being captured as something like GET:/xxx/yyy/carts/c3ui34u/status and GET:/xxx/yyy/carts/3j32j4l/status etc. i.e. the specific cartID is part of the API.
So, while doing the aggregations, each of the above is coming with a count of 1. Is there anyway (as part of visualization query), I can rename those API URLs to something as simple as GET:/xxx/yyy/carts/{id}/status, so that each of the above entries will be replaced with this generic entry, so that I will get the total count per day of ALL those cart status calls? I tried to use the setting -> Kibana -> Index Patterns -> URL format, but I was not successful (probably that is not the way to do it - may be).
Please note that I am not looking for a change in the source itself, but if there is anyway I can do this translation AS PART OF running a query to print the aggregates.
Any help is appreciated.
Thanks,
You may need to split the log up into the relevant fields at indexing time, I'm not sure you'll be able to achieve what you want with a visualization query.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.