Custom text analyzer for url encoded logs

Hi,

I am ingesting log files to Elasticsearch(v7.17.1) and using Kibana(v7.17.1) to search the logs.
Some of my log lines have url encoded strings like below. I am trying to use custom text analyzers to be able to search using the url or other query params. But because of the url encoding chars like %3D, %5E, etc, I have to use wildchars around my search texts which slows down the searching drastically. Please suggest any built-in or custom analyser which can help to get url decoded tokens. Thanks.


2022-10-13 12:13:25 INFO GenericDequeuer:86 - ce7e0473-301e-4ddd-9f47-d88096ef6075 - 06+00%3A00%3A00&i%5ELowestFare=5485&i%5ETotalFare=&s%5EReturnDepTime=&s%5EReturnArrTime=&s%5EArrDate_Text=06%2F11%2F2022&s%5EMode=&s%5EBrowser=&s%5EURL=https%3A%2F%2Fflight.etrip.com%2FFlightList%2FIndex%3Fsrch%3DLKO-Lucknow-India%7CGAU-Guwahati-India%7C06%2F11%2F2022%26px%3D1-0-0%26cbn%3D0%26ar%3Dundefined%26isow%3Dtrue%26isdm%3Dtrue%26lang%3Den-us%26utm_source%3Dgoogle%26utm_medium%3Dcpc%26utm_campaign%3D788997081%26utm_content%3D39319940377%26utm_term%3Dease%2520my%2520trip%26utm_campaign%3D788997081%26utm_rbHDDMzpndFFJWeBTpDOL52lxkTYYaAubMEALw_wcB%26CouponCode%3D%26isFml%3Dtrue%26fn%3D2%26IsDoubleSeat%3Dfalse%26CCODE%3DIN%26curr%3DINR&s%5EAirlineCode=I5&s%ct20221213228d39f4b93c3e42e4acc8c9a2c2ca41e0&d%5EArrDate=2022-11-06+00%3A00%3A0EPerpersonfare=5485&s%5EDepTime=23%3A05&d%5EInsertedOn=2022-10-13+12%3A13%3A24&s%5EDiscountAmount=&siteid=8f50f905d4bfd9bdca3816eda42269ee&s%5ESegmentsCount=47&i%5EResFare=0&s%5EDeviceId=&s%5EssionStatus=false&s%5EStateDestination=&i%5EAdults=1&s%5EMobileNo=&s%5EStateOrigin=&s%5EVid=&s%5ECID=&s%5EFlightNumber=789&i%5ETaxAmount=&i%5EBaseFare=&d%5EResTime=2022-10-13+06%3A43%3A24&s%5EIsCache=&s%5EAirpricePosition=&i%5EConvinenceFee=&customer_key=&d%5EReqTime=2022-10-13+06%3A43%3A22&s%5EReqType=AirSearch&d%5EdTrip&s%5ETransactionId=&s%5EReturnAirlineCode=&d%5EReturnDepartureDate=&s%5ECabin=0&s%5EIPAdress=136.232.109.146&s%5EEmailId='

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.