Axiom
Overview

format_url

Usage#

Syntax#

format_url(url_parts)

Parameters#

Name Type Required Description
url_parts dynamic Yes A dynamic object containing URL components: scheme, host, path, port, fragment, user, password, query.

Returns#

Returns a properly formatted URL string constructed from the provided components.

Use case examples#

Reconstruct full URLs from parsed components to analyze complete request patterns.

Query

['sample-http-logs']
| extend full_url = format_url(dynamic({'scheme': 'https', 'host': 'api.example.com', 'path': uri}))
| project _time, method, status, full_url
| limit 10

Run in Playground

Output

_time method status full_url
2024-11-06T10:00:00Z GET 200 https://api.example.com/api/users
2024-11-06T10:01:00Z POST 201 https://api.example.com/api/orders
2024-11-06T10:02:00Z GET 200 https://api.example.com/api/products

This query reconstructs full URLs from URI paths by adding the scheme and host, useful for generating clickable links in reports.

Build URLs from trace attributes to identify the full endpoints being called.

Query

['otel-demo-traces']
| extend service_url = format_url(dynamic({'scheme': 'http', 'host': 'localhost', 'port': 8080, 'path': strcat('/', ['service.name'])}))
| project _time, ['service.name'], service_url, trace_id
| limit 10

Run in Playground

Output

_time service.name service_url trace_id
2024-11-06T10:00:00Z frontend http://localhost:8080/frontend abc123
2024-11-06T10:01:00Z checkout http://localhost:8080/checkout def456
2024-11-06T10:02:00Z cart http://localhost:8080/cart ghi789

This query constructs service URLs from trace data, helping visualize the actual endpoints in a distributed system.

Construct URLs with authentication parameters to audit access attempts.

Query

['sample-http-logs']
| extend access_url = format_url(dynamic({'scheme': 'https', 'host': 'secure.example.com', 'path': uri, 'user': id}))
| project _time, access_url, status, ['geo.country']
| limit 10

Run in Playground

Output

_time access_url status geo.country
2024-11-06T10:00:00Z https://user123@secure.example.com/admin 403 United States
2024-11-06T10:01:00Z https://user456@secure.example.com/api/secret 401 Unknown

This query constructs complete URLs including user information for failed authentication attempts, helping security teams understand the full context of access attempts.

  • parse_url: Parses a URL string into its components. Use this to reverse the formatting operation and extract URL parts.
  • parse_urlquery: Parses URL query parameters. Use this when you need to work with query string parameters specifically.
  • url_encode: Encodes a string for safe use in URLs. Use this to encode individual URL components before formatting.
  • strcat: Concatenates strings. Use this for simple URL construction without the structure of format_url.

Other query languages#

Splunk SPL users

In Splunk SPL, you typically concatenate URL parts manually with eval. APL's format_url provides a structured approach.

Splunk example

| eval full_url=scheme."://".host.":".port.path

APL equivalent

['sample-http-logs']
| extend full_url = format_url(dynamic({'scheme': 'https', 'host': host, 'port': 443, 'path': path}))
ANSI SQL users

In ANSI SQL, URL formatting requires string concatenation with null handling. APL's format_url simplifies this operation.

SQL example

SELECT CONCAT(scheme, '://', host, COALESCE(CONCAT(':', port), ''), path) AS url FROM logs;

APL equivalent

['sample-http-logs']
| extend url = format_url(dynamic({'scheme': scheme, 'host': host, 'port': port, 'path': path}))

Updated

Was this page helpful?