Skip to content

Latest commit

 

History

History
182 lines (149 loc) · 4.44 KB

uri_parser.md

File metadata and controls

182 lines (149 loc) · 4.44 KB
Raw

uri_parser operator

The uri_parser operator parses the string-type field selected by parse_from as URI.

uri_parser can handle:

  • Absolute URI
    • https://google.com/v1/app?user_id=2&uuid=57b4dad2-063c-4965-941c-adfd4098face
  • Relative URI
    • /app?user=admin
  • Query string
    • ?request=681e6fc4-3314-4ccc-933e-4f9c9f0efd24&env=stage&env=dev
    • Query string must start with a question mark

Configuration Fields

Field Default Description
id uri_parser A unique identifier for the operator.
output Next in pipeline The connected operator(s) that will receive all outbound entries.
parse_from body The field from which the value will be parsed.
parse_to attributes The field to which the value will be parsed.
on_error send The behavior of the operator if it encounters an error. See on_error.
if An expression that, when set, will be evaluated to determine whether this operator should be used for the given entry. This allows you to do easy conditional parsing without branching logic with routers.

Embedded Operations

The uri_parser can be configured to embed certain operations such as timestamp and severity parsing. For more information, see complex parsers.

Output Fields

The following fields are returned. Empty fields are not returned.

Field Type Example Description
scheme string "http" URI Scheme. HTTP, HTTPS, FTP, etc.
user string "dev" Userinfo username. Password is always ignored.
host string "golang.org" The hostname such as www.example.com, example.com, example. A scheme is required in order to parse the host field.
port string "8443" The port the request is sent to. A scheme is required in order to parse the port field.
path string "/v1/app" URI request path.
query map[string][]string "query":{"user":["admin"]} Parsed URI query string.

Example Configurations

Parse the field body.message as absolute URI

Configuration:

- type: uri_parser
  parse_from: body.message
Input body Output body 
{
  "timestamp": "",
  "body": {
    "message": "https://dev:pass@google.com/app?user_id=2&token=001"
  }
}
 
{
  "timestamp": "",
  "body": {
    "host": "google.com",
    "path": "/app",
    "query": {
      "user_id": [
        "2"
      ],
      "token": [
        "001"
      ]
    },
    "scheme": "https",
    "user": "dev"
  }
}

Parse the field body.message as relative URI

Configuration:

- type: uri_parser
  parse_from: body.message
Input body Output body 
{
  "timestamp": "",
  "body": {
    "message": "/app?user=admin"
  }
}
 
{
  "timestamp": "",
  "body": {
    "path": "/app",
    "query": {
      "user": [
        "admin"
      ]
    }
  }
}

Parse the field body.query as URI query string

Configuration:

- type: uri_parser
  parse_from: body.query
Input body Output body 
{
  "timestamp": "",
  "body": {
    "query": "?request=681e6fc4-3314-4ccc-933e-4f9c9f0efd24&env=stage&env=dev"
  }
}
 
{
  "timestamp": "",
  "body": {
    "query": {
      "env": [
        "stage",
        "dev"
      ],
      "request": [
        "681e6fc4-3314-4ccc-933e-4f9c9f0efd24"
      ]
    }
  }
}