Aggregate similar URLs with dynamic patterns in stats query

[patsevanton]

Is your question related to a specific component?

LogsQL

Describe the question in detail

Hello! I'm working with nginx access logs ingested into VictoriaLogs and trying to group similar URLs using a stats query, but collapse_nums doesn't fully match my needs.

Here are sample logs (structured JSON):

nginx-log-generator nginx-log-generator {"ts":"2025-12-30T06:06:05.875361914Z","http":{"request_id":"8d5b51f4-4cc0-44e5-b6a4-0247ee3d4475","method":"GET","status_code":200,"url":"api.example.com/","host":"api.example.com","uri":"","request_time":1.936243705317258,"user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/5321 (KHTML, like Gecko) Chrome/39.0.897.0 Mobile Safari/5321","protocol":"HTTP/1.1","trace_session_id":"","server_protocol":"HTTP/1.1","content_type":"application/json","bytes_sent":"1180"},"nginx":{"x-forward-for":"10.0.0.1","remote_addr":"10.0.0.1","http_referrer":""}}
nginx-log-generator nginx-log-generator {"ts":"2025-12-30T06:06:06.874560179Z","http":{"request_id":"bf476064-458a-4e26-9d11-e752a88a9e1d","method":"POST","status_code":200,"url":"api.example.com/v2/orders/eW-CM198765432/courier","host":"api.example.com","uri":"/v2/orders/eW-CM198765432/courier","request_time":1.8907286886938046,"user_agent":"Mozilla/5.0 (Windows NT 5.01) AppleWebKit/5360 (KHTML, like Gecko) Chrome/37.0.837.0 Mobile Safari/5360","protocol":"HTTP/1.1","trace_session_id":"","server_protocol":"HTTP/1.1","content_type":"application/json","bytes_sent":"1948"},"nginx":{"x-forward-for":"10.0.0.1","remote_addr":"10.0.0.1","http_referrer":""}}

My current query:

kubernetes.container_name: "nginx-log-generator" | collapse_nums at http.url prettify | stats by (http.url) count()

Current output (shows individual order IDs):

timestamp missing http.url: api.example.com/v<N>/orders/eW-CM500123789/courier count(*): 51
timestamp missing http.url: api.example.com/v<N>/orders/eW-CM198765432/courier count(*): 61
timestamp missing http.url: api.example.com/v<N>/orders/eW-CM123456789/courier count(*): 49
timestamp missing http.url: api.example.com/v<N>/orders/eW-CM999000111/courier count(*): 40

Desired output (group all /orders//courier endpoints):

timestamp missing http.url: api.example.com/v<N>/orders/eW-CM<N>/courier count(*): 200

Questions:

Is there a regex-based collapse or pattern matching pipe? Something like collapse_regex or group_by_pattern?

Is there a better approach using parse or custom fields for URL path templating?

Thanks for the great project!
​

Key concepts docs

• VictoriaLogs key concepts - https://docs.victoriametrics.com/victorialogs/keyconcepts/
• LogsQL - https://docs.victoriametrics.com/victorialogs/logsql/

[withlin]

hi @patsevanton
can u try as bellow logsql?

kubernetes.container_name:"nginx-log-generator"
| replace_regexp("(/v)[0-9]+(/orders/)[^/]+(/courier)", "$1<N>$2<ID>$3") at http.uri
| stats by (http.uri) count()

[patsevanton]

[withlin]

hi @patsevanton pls try again:

kubernetes.container_name:"nginx-log-generator"
| replace_regexp("([A-Za-z0-9.-]+/v)[0-9]+(/orders/)[^/]+(/courier)", "$1<N>$2<ID>$3") at http.url
| stats by (http.url) count() as hits
| sort by (hits desc)
| fields http.url, hits

[patsevanton]

Work! But difficult. maybe in the future it will be possible to make a function in which you can add part of the string?

[withlin]

hi @patsevanton
how about bellow logsql? can easy to understand? that is my initial thoughts.

kubernetes.container_name:"nginx-log-generator"
| http.url:*
| collapse_template "/v<N>/orders/<ID>/courier" at http.url
| stats by (http.url) count() as hits
| sort by (hits desc)

[patsevanton]

hi @patsevanton how about bellow logsql? can easy to understand? that is my initial thoughts.

kubernetes.container_name:"nginx-log-generator"
| http.url:*
| collapse_template "/v<N>/orders/<ID>/courier" at http.url
| stats by (http.url) count() as hits
| sort by (hits desc)

Yes

or

kubernetes.container_name:"nginx-log-generator"
| http.url:*
| collapse_template "/v1/orders/<ID>/courier" at http.url
| stats by (http.url) count() as hits
| sort by (hits desc)

or

kubernetes.container_name:"nginx-log-generator"
| http.url:*
| collapse_template "/v1/orders/CM-<ID>/courier" at http.url
| stats by (http.url) count() as hits
| sort by (hits desc)

[withlin]

hi @patsevanton i was creating new feature: #985, u can have a look.