Visualize grouped endpoints excluding unique IDs

Elastic Stack Kibana
1

Hi I'm trying to get a visualization of the count of endpoints hit in a timeframe. My issue is that when I add my url.path feild to the visualization it displays like this (as an example)

/rest/endpoint/8372812
/rest/endpoint/3781293

What I would like to happen is that I get the total count of records excluding the ID that's in the url so instead of the above showing 2 seperate results I would see it all grouped as

/rest/endpoint/

I've tried using the exclude field and I've tried using the filter but I just can't get it to display what I need, is this possible? can anyone help please? Thanks!

2

Anyone have any insight on this, I'd imagine it's quite a common thing to want to do

3

In order to do this you would have to split that url.path in a root and an id field, preferably at ingest time. But if you want to see that it works you can do that in a runtime field.

4

Thanks @Marius_Dragomir , are there any docs you could point too that would help explain and implement your solution here?

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.