URL Fields
editURL Fields
editURL fields provide support for complete or partial URLs, and supports the breaking down into scheme, domain, path, and so on.
URL Field Details
editField | Description | Level |
---|---|---|
url.domain |
Domain of the url, such as "www.elastic.co". In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the type: keyword example: |
extended |
url.fragment |
Portion of the url after the The type: keyword |
extended |
url.full |
If full URLs are important to your use case, they should be stored in type: keyword example: |
extended |
url.original |
Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not. type: keyword example: |
extended |
url.password |
Password of the request. type: keyword |
extended |
url.path |
Path of the request, such as "/search". type: keyword |
extended |
url.port |
Port of the request, such as 443. type: long example: |
extended |
url.query |
The query field describes the query string of the request, such as "q=elasticsearch". The type: keyword |
extended |
url.scheme |
Scheme of the request, such as "https". Note: The type: keyword example: |
extended |
url.username |
Username of the request. type: keyword |
extended |