In DQL DPL, what is the best way to separate an endpoint and its target?

chloe_bennett — Fri, 04 Apr 2025 22:42:23 GMT

Hello! Using DQL, I'd like to use the "parse" command to break a string like "/api/abc/abc/abc/123" into "endpoint=/api/abc/abc/abc/", and "target=123". Ideally, I can apply this to any incoming API call. The strings may represent different API calls, so the output I'm looking for is something like the following:

"/api/abc/abc/abc/123" => "endpoint=/api/abc/abc/abc/{*}" and "target=123"
"/api/abc/123" => "endpoint=/api/abc/{*}" and "target=123"
"/api/abc/abc/123/def" => "endpoint=/api/abc/abc/{*}/def" and "target=123"

I'm trying to make the "{*}" a literal replacement for the data that I take out.

The end goal is to eventually aggregate the occurrences of a specific endpoint even without the target, or interactions with a target even without the endpoint.

Would you have any idea how to do this? I'd really appreciate the help! Thanks in advance!

Re: In DQL DPL, what is the best way to separate an endpoint and its target?

yanezza — Sat, 05 Apr 2025 16:47:36 GMT

Hello!

Using DQL, it is feasible to achieve this. I will execute two pipe:

the first to extract the target
NOTE: this is where you need to handle the complexity, but with DPL you can manage it well)
and then I will generate the endpoint fields using a replaceString function with the target string.
NOTE: If you need more complexity, you could also use a replacePattern function.

data record(span = "/api/abc/abc/abc/123") | fieldsAdd parse(span," '/api/abc/abc/abc/' LD:target") | fieldsAdd endpoint = replaceString(span, target, "{*}" ) | fields target, endpoint

topic In DQL DPL, what is the best way to separate an endpoint and its target? in DQL

In DQL DPL, what is the best way to separate an endpoint and its target?

Re: In DQL DPL, what is the best way to separate an endpoint and its target?