Expressions for extracting segments of URLs
You can extract URLs and portions of URLs, such as the host name, or a segment of the URL path. For example, the following expression identifies HTTP requests for image files by extracting image file suffixes from the URL:
http.req.url.suffix.eq("jpeg") || http.req.url.suffix.eq("gif")
Most expressions for URLs operate on text and are described in Expression Prefixes for Text in HTTP Requests and Responses. This section discusses the GET operation. The GET operation extracts text when used with the following prefixes:
The following table describes prefixes for HTTP URLs.
|HTTP.REQ.URL.PATH.GET(<n>)||Returns a slash- (“/”) separated list from the URL path. For example, consider the following URL:
|HTTP.REQ.URL.PATH.GET_REVERSE(<n>)||Returns a slash- (“/”) separated list from the URL path, starting from the end of the path. For example, consider the following URL: