Extract certain values from Url.Query field

I currently have a Fleet module set up to ingest IIS logs into Kibana.
Within the logs they contain the filed URL.Query, which holds alot of information.
What i would like to do is to turn all of the parameters inside the URL.Query into fields themselves. For instance

I would like to be able to see "gameId" and "GameSessionId" as fields.

I can see a similar question posted on

However there is no answer on this. Could someone please provide some information or advice, thank you :).

Not sure if this is important, but the agent.type is "filebeats"

I think you can open an enhancement request (issue) in the elastic/integrations repo. It would be a nice improvement.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.