[7.x] URI parts ingest processor #66191
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Adds a new
uri_parts
processor that decomposes a URI into its constituent parts. E.g.:results in:
The processor relies on the
java.net.URI
class to parse the URI and attempts to map the parts into ECS fields. Some ECS fields are not part of the URI spec, so see the table below for how those are handled:.
exists in the pathusername
orpassword
though they are commonly presented with theusername:password
convention. Theusername
andpassword
fields are parsed out of theuser_info
field on a best-effort basis if a:
exists.password
aboveAlso introduces a new module for ingest processors.
Closes #57481
Backport of #65150