By using LogCollector url_parse plugin, you can parse URL strings in specified fields. Besides, you can extract components from URL strings (such as scheme, host, port, path, query, fragment, username, and password) and add them to your logs.

Notice

This plugin is supported in LogCollector V2.2.5 and later versions. To view LogCollector version, see 2. View software version.

url_parse plugin parameter description

Name	Type	Required	Description
field	String	Yes	Name of the field that contains the URL string.
allow_decode	Boolean	No	Decode the value of the field using URL decoding before parsing.
parse_query	Boolean	No	The parameter determines whether to parse query parameters from the URL string into separate fields and add them to the logs.
keep_source	Boolean	No	The parameter determines whether to retain the original field value.

url_parse plugin configuration example

Log content:

{
"request_url": "https%3A%2F%2Fuser%3Apass%40example.com%3A8080%2Fpath%2Fto%2Fresource%3Fparam1%3Dvalue1%26param2%3Dvalue2%23section1"
}

Processor configuration of LogCollector url_parse plugin

Retain no original field; extract the URL string from request_url; decode the string and add each query parameter as a separate field to the log.

{
"processors": [
{
"url_parse": {
"field": "request_url",
"allow_decode": true,
"keep_source": false,
"parse_query": true
}
}
]
}

Processing result:

{
"url_scheme": "https",
"url_username": "user",
"url_password": "pass",
"url_host": "example.com:8080",
"url_port": "8080",
"url_path": "/path/to/resource",
"url_query": "param1=value1&param2=value2",
"url_params_param1": "value1",
"url_params_param2": "value2",
"url_fragment": "section1"
}

Last updated: 2025.12.12 14:07:35

Public security network record in Beijing: No. 11010802032137