---
title: ES|QL URI_PARTS command
description: 
url: https://www.elastic.co/elastic/docs-builder/docs/3016/reference/query-languages/esql/commands/uri-parts
products:
  - Elasticsearch
---

# ES|QL URI_PARTS command
<applies-to>
  - Elastic Cloud Serverless: Preview
  - Elastic Stack: Planned
</applies-to>

The `URI_PARTS` processing command parses a Uniform Resource Identifier (URI) string and extracts its components into new columns.
<note>
  This command doesn't support multi-value inputs.
</note>

**Syntax**
```esql
URI_PARTS prefix = expression
```

**Parameters**
<definitions>
  <definition term="prefix">
    The prefix for the output columns. The extracted components are available as `prefix.component`.
  </definition>
  <definition term="expression">
    The string expression containing the URI to parse.
  </definition>
</definitions>

**Description**
The `URI_PARTS` command parses a URI string and extracts its components into new columns.
The new columns are prefixed with the specified `prefix` followed by a dot (`.`).
This command is the query-time equivalent of the [URI parts ingest processor](https://www.elastic.co/elastic/docs-builder/docs/3016/reference/enrich-processor/uri-parts-processor).
The following columns are created:
<definitions>
  <definition term="prefix.domain">
    The host part of the URI.
  </definition>
  <definition term="prefix.fragment">
    The fragment part of the URI (the part after `#`).
  </definition>
  <definition term="prefix.path">
    The path part of the URI.
  </definition>
  <definition term="prefix.extension">
    The file extension extracted from the path.
  </definition>
  <definition term="prefix.port">
    The port number as an integer.
  </definition>
  <definition term="prefix.query">
    The query string part of the URI (the part after `?`).
  </definition>
  <definition term="prefix.scheme">
    The scheme (protocol) of the URI (e.g., `http`, `https`, `ftp`).
  </definition>
  <definition term="prefix.user_info">
    The user information part of the URI.
  </definition>
  <definition term="prefix.username">
    The username extracted from the user information.
  </definition>
  <definition term="prefix.password">
    The password extracted from the user information.
  </definition>
</definitions>

If a component is missing from the URI, the corresponding column contains `null`.
If the expression evaluates to `null`, all output columns are `null`.
If the expression is not a valid URI, a warning is issued and all output columns are `null`.
**Examples**
The following example parses a URI and extracts its parts:
```esql
ROW uri = "http://myusername:mypassword@www.example.com:80/foo.gif?key1=val1&key2=val2#fragment"
| URI_PARTS parts = uri
| KEEP parts.*
```


| parts.domain:keyword | parts.fragment:keyword | parts.path:keyword | parts.extension:keyword | parts.port:integer | parts.query:keyword | parts.scheme:keyword | parts.user_info:keyword | parts.username:keyword | parts.password:keyword |
|----------------------|------------------------|--------------------|-------------------------|--------------------|---------------------|----------------------|-------------------------|------------------------|------------------------|
| www.example.com      | fragment               | /foo.gif           | gif                     | 80                 | key1=val1&key2=val2 | http                 | myusername:mypassword   | myusername             | mypassword             |

You can use the extracted parts in subsequent commands, for example to filter by domain:
```esql
FROM web_logs
| URI_PARTS p = uri
| WHERE p.domain == "www.example.com"
| STATS COUNT(*) BY p.path
```