The ends_with()
function checks if a given value ends with a specified suffix.
ends_with(value, suffix)
value
: The value to check (field name, bytes)suffix
: The suffix to match against (literal bytes)Returns a boolean value: true
if the value ends with the specified suffix, false
otherwise.
ends_with(http.request.uri, ".html") // Checks if the URI ends with ".html"