Expressions for extracting segments of URLs

Last published : Sep 22, 2026
You can extract URLs and portions of URLs, such as the host name, or a segment of the URL path. For example, the following expression identifies HTTP requests for image files by extracting image file suffixes from the URL:
http.req.url.suffix.eq("jpeg") || http.req.url.suffix.eq("gif")
Most expressions for URLs operate on text and are described in Expression Prefixes for Text in HTTP Requests and Responses. This section discusses the GET operation. The GET operation extracts text when used with the following prefixes:
  • HTTP.REQ.URL.PATH
  • VPN.BASEURL.PATH
  • VPN.CLIENTLESS_BASEURL.PATH
The following table describes prefixes for HTTP URLs.
URL Prefix Description
HTTP.REQ.URL.PATH.GET(<n>) Returns a slash- (“/”) separated list from the URL path. For example, consider the following URL:<http://www.mycompany.com/dir1/dir2/dir3/index.html?a=1>. The following expression returns dir1 from this URL:<http.req.url.path.get(1)>. The following expression returns dir2: http.req.url.path.get(2)
HTTP.REQ.URL.PATH.GET_REVERSE(<n>) Returns a slash- (“/”) separated list from the URL path, starting from the end of the path. For example, consider the following URL: <http://www.mycompany.com/dir1/dir2/dir3/index.html?a=1>. The following expression returns index.html from this URL: <http.req.url.path.get_reverse(0)>. The following expression returns dir3: http.req.url.path.get_reverse(1)