On a non-elastic related note, using the URL to store secrets is bad idea, if at all possible I would advise you to have the application changed instead of only obfuscating the logs within elastic.
Couple of sources to help understand why this is a bad idea: