I want to create an aggregation pie chart with request/reply sizes of some URLs, from squid proxy logs. But I wish to group the URLs from the same domain in the visualization. See the image below:
I think you would have to do the heavy lifting in a pipeline rule ahead of time, use regex or something and then write that to a new field and then group by that.
Yeah, I thought so. Just wanted to make sure that there wasn’t some feature that I don’t know about that would allow this grouping without the need for treatment in a pipeline.