[zscaler_zia.web] url.original parsing is incorrect when scheme is missing

[andrewkroh]

When url.original field (eurl) does not contain a scheme then the rest of the url.* fields are incorrect. Particularly url.domain is missing.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[andrewkroh]

One idea would be to use the proto field and the eurl fields to create ECS url.full. Then derive the rest of the URL fields from that url.full: {proto}://{eurl} value. Then I expect the URI Parts processor would function correctly.

https://www.elastic.co/guide/en/ecs/current/ecs-url.html#field-url-full