diff --git a/docs/reference/ingest/ingest-node.asciidoc b/docs/reference/ingest/ingest-node.asciidoc index 4edf12d2c908e..cf0ecc69ec9aa 100644 --- a/docs/reference/ingest/ingest-node.asciidoc +++ b/docs/reference/ingest/ingest-node.asciidoc @@ -906,4 +906,5 @@ include::processors/split.asciidoc[] include::processors/trim.asciidoc[] include::processors/uppercase.asciidoc[] include::processors/url-decode.asciidoc[] +include::processors/uri-parts.asciidoc[] include::processors/user-agent.asciidoc[] diff --git a/docs/reference/ingest/processors/uri-parts.asciidoc b/docs/reference/ingest/processors/uri-parts.asciidoc new file mode 100644 index 0000000000000..6b55c263d9478 --- /dev/null +++ b/docs/reference/ingest/processors/uri-parts.asciidoc @@ -0,0 +1,82 @@ +[role="xpack"] +[testenv="basic"] +[[uri-parts-processor]] +=== URI parts processor +++++ +URI Parts +++++ + +Parses a Uniform Resource Identifier (URI) string and extracts its components as +an object. This URI object includes properties for the URI's domain, path, fragment, +port, query, scheme, user info, username, and password. + +[[uri-parts-options]] +.URI Parts Options +[options="header"] +|====== +| Name | Required | Default | Description +| `field` | yes | - | Field containing the URI string. +| `target_field` | no | `url` | Output field for the URI object. +| `keep_original` | no | true | If `true`, the processor copies the +unparsed URI to `.original`. +| `remove_if_successful` | no | false | If `true`, the processor removes +the `field` after parsing the URI string. If parsing fails, the processor does not +remove the `field`. + +include::common-options.asciidoc[] +|====== + +Here is an example definition of the URI parts processor: + +[source,js] +-------------------------------------------------- +{ + "description" : "...", + "processors" : [ + { + "uri_parts": { + "field": "input_field", + "target_field": "url", + "keep_original": true, + "remove_if_successful": false + } + } + ] +} +-------------------------------------------------- +// NOTCONSOLE + +When the above processor executes on the following document: + +[source,js] +-------------------------------------------------- +{ + "_source": { + "input_field": "http://myusername:mypassword@www.example.com:80/foo.gif?key1=val1&key2=val2#fragment" + } +} +-------------------------------------------------- +// NOTCONSOLE + +It produces this result: + +[source,js] +-------------------------------------------------- +"_source" : { + "input_field" : "http://myusername:mypassword@www.example.com:80/foo.gif?key1=val1&key2=val2#fragment", + "url" : { + "path" : "/foo.gif", + "fragment" : "fragment", + "extension" : "gif", + "password" : "mypassword", + "original" : "http://myusername:mypassword@www.example.com:80/foo.gif?key1=val1&key2=val2#fragment", + "scheme" : "http", + "port" : 80, + "user_info" : "myusername:mypassword", + "domain" : "www.example.com", + "query" : "key1=val1&key2=val2", + "username" : "myusername" + } +} +-------------------------------------------------- +// NOTCONSOLE