[SOLVED] How can I group URL paths that have different ids into one result in Datadog?

How can I group URL paths that have different ids into one result in Datadog?

I have created a pie chart in Datadog that displays all URLs containing the string "\test". The filter I am using is @http.url_details.path:*\test*

This filter is working well and I am getting all the different URLs in my pie chart. However, my problem is that some URLs contain an ID which I would like to group into a single value in my pie chart.

For example, I have multiple URLs like:

\test\test-id\12
\test\test-id\34
\test\test-id\56

I do not want each unique test ID to appear as separate values in my chart. Instead, I would like to aggregate these into a single value, so that I only see "\test\test-id" in my chart.

Is there any way to achieve this in Datadog?

Solution

In your log pipeline, after the processor that is extracting the URL details, add a grok parser. Put http.url_details.path as the Extract from value. Use a grok pattern such as %{GREEDYDATA:partial_url}\\ (see in grok debugger). Then you can filter by the new attribute you've extracted.