I'm trying to aggregate the API logs based on the different endpoints I have. There are a total of 4 endpoints:
The way I'm currently doing this is:
_sourceCategory=production | keyvalue auto | where (path matches "/v1/driver_locations" OR path matches "/v1/driver_locations/*" or path matches "/v1/vehicle_locations" or path matches "/v1/vehicle_locations/*") | count by path
The problem with this is that while I get the correct aggregate for
/v1/driver_locations, I get individual results for
/v1/vehicle_locations/id since the id is a wildcard. Is there a way I can aggregate these wildcards as well to show the total calls to
/v1/driver_locations/id and /v1/vehicle_locations/id respectively?
Please sign in to leave a comment.