In DQL DPL, what is the best way to separate an endpoint and its target?

[chloe_bennett]

Hello! Using DQL, I'd like to use the "parse" command to break a string like "/api/abc/abc/abc/123" into "endpoint=/api/abc/abc/abc/", and "target=123". Ideally, I can apply this to any incoming API call. The strings may represent different API calls, so the output I'm looking for is something like the following:

• "/api/abc/abc/abc/123" => "endpoint=/api/abc/abc/abc/{*}" and "target=123"
• "/api/abc/123" => "endpoint=/api/abc/{*}" and "target=123"
• "/api/abc/abc/123/def" => "endpoint=/api/abc/abc/{*}/def" and "target=123"

I'm trying to make the "{*}" a literal replacement for the data that I take out.

The end goal is to eventually aggregate the occurrences of a specific endpoint even without the target, or interactions with a target even without the endpoint.

Would you have any idea how to do this? I'd really appreciate the help! Thanks in advance!

[yanezza · Accepted solution]

Hello!

Using DQL, it is feasible to achieve this. I will execute two pipe:

1. the first to extract the target
   NOTE: this is where you need to handle the complexity, but with DPL you can manage it well)
2. and then I will generate the endpoint fields using a replaceString function with the target string.
   NOTE: If you need more complexity, you could also use a replacePattern function.

data record(span = "/api/abc/abc/abc/123")
| fieldsAdd parse(span," '/api/abc/abc/abc/' LD:target")
| fieldsAdd endpoint = replaceString(span, target, "{*}" )
| fields target, endpoint