Extract certain values from Url.Query field

[jamesm1 (James)]

I currently have a Fleet module set up to ingest IIS logs into Kibana.
Within the logs they contain the filed URL.Query, which holds alot of information.
What i would like to do is to turn all of the parameters inside the URL.Query into fields themselves. For instance
gameId=759&gameSessionId=3358711541

I would like to be able to see "gameId" and "GameSessionId" as fields.

I can see a similar question posted on

How to Parse url.query into Different Fields?

Hello, thanks for the question about filebeat. In your configuration, is filebeat shipping directly to elasticsearch, or does filebeat first ship data to logstash for enrichment or filtering. If you're using logstash, this could be a possible good portion of the pipeline to split about the url.query string. If you're using logstash, I would recommend looking at the grok filter plugin: https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html

However there is no answer on this. Could someone please provide some information or advice, thank you :).

Not sure if this is important, but the agent.type is "filebeats"

[mtojek (Marcin Tojek)]

I think you can open an enhancement request (issue) in the elastic/integrations repo. It would be a nice improvement.