I have used rex to extract a URL from log message. I then want to eliminate the parameter values so I can build statistics based on the URL. To do this I use the following rex command:
rex field=request_url mode=sed "s/=[^&]*//g"
With the following input:
/UsomCustomer/customers?storeNumber=####&phone=##########
I get:
/UsomCustomer/customers?storeNumber
but I expect
/UsomCusteomr/customers?storeNumber&phone
When I execute sed locally with the same expression and the same input it works.
$ sed 's/=[^&]*//g' < test-sed.txt
/UsomCustomer/customers?storeNumber&phone
One curious thing is that when I take away the second rex command and look at the "request_url" field in the UI. I see '\u0026' instead of & in the display.
Hi danapsimer,
try something like
| rex field=request_url "^(?<url>[^\?]*)"
Bye.
Giuseppe
When I run the following, it get what you are expecting:
| makeresults
| eval url="/UsomCustomer/customers?storeNumber=####&phone=##########"
| rex field=url mode=sed "s/=[^&]*//g"
which is:
/UsomCustomer/customers?storeNumber&phone
It does look like you have a character issue in the search string.