URI Parts

Parse Elastic Compatible

Synopsis

Parses a Uniform Resource Identifier (URI) string and extracts its components into a structured object.

Schema

uri_parts:
  - field: <ident>
  - description: <text>
  - if: <script>
  - ignore_failure: <boolean>
  - ignore_missing: <boolean>
  - keep_original: <boolean>
  - on_failure: <processor[]>
  - on_success: <processor[]>
  - remove_if_successful: <boolean>
  - tag: <string>
  - target_field: <ident>

Configuration

Field	Required	Default	Description
field	Y	-	Field containing the URI string
description	N	-	Explanatory note
if	N	-	Condition to run
ignore_failure	N	false	See Handling Failures
ignore_missing	N	false	If true, quietly exit if field doesn't exist
keep_original	N	true	Include original URI in output
on_failure	N	-	See Handling Failures
on_success	N	-	See Handling Success
remove_if_successful	N	false	Remove source field after successful parsing
tag	N	-	Identifier
target_field	N	url	Field to store the parsed components

Details

The processor extracts various URI components including scheme, domain, port, path, query parameters, fragment, user information, and file extension. Empty or zero-value components are omitted from the output.

warning

URIs with invalid syntax will cause the processor to fail unless ignore_failure is set to true.

Both IPv4 and IPv6 addresses are supported in the domain component.

security

For security reasons, be cautious when processing URIs with authentication information.

Examples

Basic

Parsing a complete URI...	{ "url": "http://myusername:[email protected]:80/foo.gif?key1=val1&key2=val2#fragment" } uri_parts: - field: url - target_field: uri_parts
extracts all the components:	{ "uri_parts": { "scheme": "http", "domain": "www.example.com", "port": 80, "path": "/foo.gif", "query": "key1=val1&key2=val2", "fragment": "fragment", "user_info": "myusername:mypassword", "username": "myusername", "password": "mypassword", "extension": "gif", "original": "http://myusername:[email protected]:80/foo.gif?key1=val1&key2=val2#fragment" } }

Omit Original

Parsing a URI without keeping the original...	{ "url": "http://example.com:8080/path?q=search" } uri_parts: - field: url - target_field: parsed - keep_original: false
outputs only the parsed components:	{ "parsed": { "scheme": "http", "domain": "example.com", "port": 8080, "path": "/path", "query": "q=search" } }

Omit Source

Removing the original field after parsing...	{ "source_url": "https://api.example.com/data.json" } uri_parts: - field: source_url - target_field: uri - remove_if_successful: true
keeps only the parsed components:	{ "uri": { "scheme": "https", "domain": "api.example.com", "path": "/data.json", "extension": "json", "original": "https://api.example.com/data.json" } }