# Decode URL Query After use KV Filter
**URL:** https://discuss.elastic.co/t/decode-url-query-after-use-kv-filter/200579
**Category:** Logstash
**Created:** [September 22, 2019, 11:53am UTC](https://discuss.elastic.co/t/decode-url-query-after-use-kv-filter/200579 "2019-09-22T11:53:04Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@gholeh89](https://discuss.elastic.co/u/gholeh89)
#### Post date: [September 22, 2019, 11:53am UTC](https://discuss.elastic.co/t/decode-url-query-after-use-kv-filter/200579/1 "2019-09-22T11:53:05Z")
Hi,
I am new to Logstash and my case need get all logs from s3 cloudfront logs format the problem when using decode filter plugin this my code
> Blockquote
> input {
```
s3 {
bucket => "test"
access_key_id => "test"
secret_access_key => "test"
}
```
}
filter {
```
csv {
separator => " "
columns => ["date", "time", "x-edge-location", "sc-bytes", "c-ip", "cs-method", "cs(Host)", "cs-uri-stem", "sc-status", "cs(Referer)", "cs(User-Agent)", "cs-uri-query", "cs(Cookie)", "x-edge-result-type", "x-edge-request-id", "x-host-header", "cs-protocol", "cs-bytes", "time-taken", "x-forwarded-for", "ssl-protocol", "ssl-cipher", "x-edge-response-result-type", "cs-protocol-version", "fle-status", "fle-encrypted-fields"]
}
```
grok {
match =\> ["message", "%{URIPARAM:cs-uri-query}"]
}
```
kv {
source => "cs-uri-query"
field_split => "&"
}
urldecode {
charset => "UTF-8"
field => "ue_px"
}
mutate
{
remove_field => ["message"]
}
```
codec-cloudfront
}
output {
elasticsearch {
```
hosts => ["localhost:9200"]
index => "test"
document_type => "logs"
```
}
stdout { codec =\> rubydebug }
}
> Blockquote
The ue\_px field param from cs-uri-query and I need decode this param
any help
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 20, 2019, 12:05pm UTC](https://discuss.elastic.co/t/decode-url-query-after-use-kv-filter/200579/2 "2019-10-20T12:05:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.