# Analyze and extract from url?
**URL:** https://discuss.elastic.co/t/analyze-and-extract-from-url/60204
**Category:** Logstash
**Created:** [September 10, 2016, 1:07am UTC](https://discuss.elastic.co/t/analyze-and-extract-from-url/60204 "2016-09-10T01:07:29Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Allie\_Yang](https://discuss.elastic.co/u/Allie_Yang)
#### Post date: [September 10, 2016, 1:07am UTC](https://discuss.elastic.co/t/analyze-and-extract-from-url/60204/1 "2016-09-10T01:07:30Z")
Hi I am thinking of analyzing the urls and need to extract some information. For example, for below url,
- [https://it.fotolia.com/id/102342882](https://it.fotolia.com/id/102342882)" : _i will need to extract id = 102342882_
- [https://us.fotolia.com/search](https://us.fotolia.com/search)? **k=great+dental+smile** &filters%5Bcontent\_type%3Aall%5D=1&search-submit=Search" :
_i will need to extract k=great+dental+smile_
Is there way i can do? like what methods i should use?
Tks!
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 11, 2016, 8:01pm UTC](https://discuss.elastic.co/t/analyze-and-extract-from-url/60204/2 "2016-09-11T20:01:52Z")
For the first example, use a grok filter. For the second example, use a grok filter to extract the part after "/search?", then use the kv filter to parse the list of key/value pairs. The resulting `k` field will need to be passed through a urldecode filter, but that filter won't turn the plus sign into space so I believe you need a final mutate filter with a gsub option that fixes that. Actually, you should probably put that filter before the urldecode filter.
---
### Author:  [@Allie\_Yang](https://discuss.elastic.co/u/Allie_Yang)
#### Post date: [September 12, 2016, 7:09pm UTC](https://discuss.elastic.co/t/analyze-and-extract-from-url/60204/3 "2016-09-12T19:09:39Z")
Tks. For the **1st one,** i have below config:
if [url] =~ "._/.\*.com/id/.\*"{
grok{
match =\> { "url" =\> "._.com/id/%{NUMBER: image\_id}" }
}
I use conditional since this is only one format of the url. **I have syntax error but i am not sure how to correct.** Would you mind give some tip? Thanks!!
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 13, 2016, 5:46am UTC](https://discuss.elastic.co/t/analyze-and-extract-from-url/60204/4 "2016-09-13T05:46:54Z")
Well, you're never closing the conditional (i.e. there's a } missing at the end) but otherwise it should work.
You should use `\.com` instead of `.com` in the expression.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:38am UTC](https://discuss.elastic.co/t/analyze-and-extract-from-url/60204/5 "2017-07-06T04:38:50Z")