Elasticsearch query to match a pattern and replace it with regex - regex

Question

I have to get the TOP 5 hit APIs/Urls and display with the http statuses of each url and I am able to do it in a way with the below extraction query
{
"query": {
"bool": {
"must": [
{
"range": {
"#timestamp": {
"from": "now-15m",
"to": "now",
"include_lower": true,
"include_upper": true,
"boost": 1
}
}
}
],
"adjust_pure_negative": true,
"boost": 1
}
},
"aggregations": {
"Url": {
"terms": {
"field": "data.url.keyword",
"size": 5,
"min_doc_count": 1,
"shard_min_doc_count": 0,
"show_term_doc_count_error": false,
"order": [
{
"_count": "desc"
},
{
"_key": "asc"
}
]
},
"aggregations": {
"Status": {
"terms": {
"field": "data.response.status",
"size": 5,
"min_doc_count": 1,
"shard_min_doc_count": 0,
"show_term_doc_count_error": false,
"order": [
{
"_count": "desc"
},
{
"_key": "asc"
}
]
}
}
}
}
}
}
Output :
"aggregations": {
"Url": {
"doc_count_error_upper_bound": 940,
"sum_other_doc_count": 52374,
"buckets": [
{
"Status": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"doc_count": 3,
"key": 200
},
{
"doc_count": 254,
"key": 400
}
]
},
"doc_count": 3515,
"key": "/account/me/"
},
{
"Status": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"doc_count": 3376,
"key": 200
}
]
},
"doc_count": 3385,
"key": "/PlanDetails"
},
{
"Status": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"doc_count": 3282,
"key": 200
}
]
},
"doc_count": 3282,
"key": "/evaluation"
},
{
"Status": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"doc_count": 3205,
"key": 200
}
]
},
"doc_count": 3205,
"key": "/user/me"
},
{
"Status": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"doc_count": 3055,
"key": 200
}
]
},
"doc_count": 3055,
"key": "/user"
}
]
}
}
}
But I have few URL where user ID comes inbetween the URLs.
For eg URLs like
/account/me/3417375321062014.cust
DJXXODKNPA1581975RI/PlanDetails
KXVEIPBYSR1597110677RI/payment
Because of distinct user ID inside the URL, elastic search considers these as separate one.
User ID is a mix of alphabets and numbers, sometimes only numbers and few only alphabets.
I need to replace these userID's in URL and count them as one
Lets say there are two hits with 200 status for /payment
DJXXODKNPA1583201975RI/payment
KXVEIPBYSR1597110677RI/payment
I should be able to replace the user ID with * and count as one API so I get output like
*/payment 200:2
But now it considers these as distinct URL/API, because of this I am unable to get the correct Top 5 Hit urls/APIs.
Any idea on this would be a great help. Thanks