Type to search.

ES|QL URI_PARTS command

Serverless Preview

Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud.

Availability

  • Preview

    This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply.

Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

Stack Preview 9.4+

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.

Availability

  • Preview since 9.4

    This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply.

Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.

This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

The URI_PARTS processing command parses a Uniform Resource Identifier (URI) string and extracts its components into new columns.

Note

This command doesn't support multi-value inputs.

ES|QL 
URI_PARTS prefix = expression
prefix
The prefix for the output columns. The extracted components are available as prefix.component.
expression
The string expression containing the URI to parse.

The URI_PARTS command parses a URI string and extracts its components into new columns. The new columns are prefixed with the specified prefix followed by a dot (.).

This command is the query-time equivalent of the URI parts ingest processor.

The following columns are created:

prefix.domain
The host part of the URI.
prefix.fragment
The fragment part of the URI (the part after #).
prefix.path
The path part of the URI.
prefix.extension
The file extension extracted from the path.
prefix.port
The port number as an integer.
prefix.query
The query string part of the URI (the part after ?).
prefix.scheme
The scheme (protocol) of the URI (e.g., http, https, ftp).
prefix.user_info
The user information part of the URI.
prefix.username
The username extracted from the user information.
prefix.password
The password extracted from the user information.

If a component is missing from the URI, the corresponding column contains null. If the expression evaluates to null, all output columns are null. If the expression is not a valid URI, a warning is issued and all output columns are null.

The following example parses a URI and extracts its parts:

ES|QL 
ROW uri = "http://myusername:mypassword@www.example.com:80/foo.gif?key1=val1&key2=val2#fragment"
| URI_PARTS parts = uri
| KEEP parts.*
parts.domain:keyword parts.fragment:keyword parts.path:keyword parts.extension:keyword parts.port:integer parts.query:keyword parts.scheme:keyword parts.user_info:keyword parts.username:keyword parts.password:keyword
www.example.com fragment /foo.gif gif 80 key1=val1&key2=val2 http myusername:mypassword myusername mypassword

You can use the extracted parts in subsequent commands, for example to filter by domain:

ES|QL 
FROM web_logs
| URI_PARTS p = uri
| WHERE p.domain == "www.example.com"
| STATS COUNT(*) BY p.path