Group Data Table messages using a field Graylog

Question

I have a Data Table connected to a stream where I receive the connections to the services. A field in the entering messages has a URL with the format domain.com/service/client_id, and I visualized them alongside other insights, resulting in something like:

• domain.com/service1/client1 Insight1 Insight2
• domain.com/service1/client2 Insight1 Insight2
• domain.com/service1/client3 Insight1 Insight2
• domain.com/service1/client4 Insight1 Insight2

The problem comes when I try to group them in a single field related to the service, like:

• domain.com/service1/ Insight1 Insight2
• domain.com/service2/ Insight1 Insight2

Is there a way to achieve this? I have been searching and nothing has helped me out so far.

Answer 1

You can use the concat function in a pipeline to concatenate multiple fields in a new field, like this (based on the example shown in the documentation):

let concat_field1 = concat(to_string($message.url)," ");

let concat_field2 = concat(concat_field1, " ");

let concat_field3 = concat(concat_field2, to_string($message.insight1));

let concat_field4 = concat(concat_field3, " ");

let concat_field5 = concat(concat_field4, to_string($message.insight2));

set_field("concat_field", concat_field5);