# Filter a request string from a specific character/string to another character to get the contents
**URL:** https://discuss.elastic.co/t/filter-a-request-string-from-a-specific-character-string-to-another-character-to-get-the-contents/57150
**Category:** Kibana
**Created:** [August 3, 2016, 9:05pm UTC](https://discuss.elastic.co/t/filter-a-request-string-from-a-specific-character-string-to-another-character-to-get-the-contents/57150 "2016-08-03T21:05:41Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@LangHolloman](https://discuss.elastic.co/u/LangHolloman)
#### Post date: [August 3, 2016, 9:05pm UTC](https://discuss.elastic.co/t/filter-a-request-string-from-a-specific-character-string-to-another-character-to-get-the-contents/57150/1 "2016-08-03T21:05:41Z")
This question is in relation to Visualizations. The purpose is to get insight into the search terms of an application that has a request.raw string exampled as: search?q=philadelphia&page=1. 'philadelphia' is the search term field portion of the string that I would like to get insight into what users are inputting in that field for search terms. Any suggestions for Discover to Visualizations of how to accomplish this, would be greatly appreciated.
One thought is:
to filter/aggregate specifically on the terms in a request.raw string from a specific character(s) to a specific character(s) later in the string. Here's an example of a string I would like to aggregate specifically on the terms from the 'q=' characters to the '&page' characters:
search?q=news&page=1
search?q=philadelphia&page=1
Suggestions?
---
### Author:  [@shaunak](https://discuss.elastic.co/u/shaunak)
#### Post date: [August 3, 2016, 9:37pm UTC](https://discuss.elastic.co/t/filter-a-request-string-from-a-specific-character-string-to-another-character-to-get-the-contents/57150/2 "2016-08-03T21:37:39Z")
Honestly, I'd suggest doing this sort of parsing before the data gets into Elasticsearch so that each document has a field `q` whose value is `philadelphia`, etc. Then you can run whatever aggregations on the `q` field.
Given that you referred to `request.raw` in your post, I assume you are using Logstash. You can use the [kv filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html) with its `field_split` parameter set to `&` to generate fields from query string parameters in your request URIs.
---
### Author:  [@LangHolloman](https://discuss.elastic.co/u/LangHolloman)
#### Post date: [August 3, 2016, 10:16pm UTC](https://discuss.elastic.co/t/filter-a-request-string-from-a-specific-character-string-to-another-character-to-get-the-contents/57150/3 "2016-08-03T22:16:40Z")
makes sense, I'll try that with the logs in logstash
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:42pm UTC](https://discuss.elastic.co/t/filter-a-request-string-from-a-specific-character-string-to-another-character-to-get-the-contents/57150/4 "2017-07-06T13:42:09Z")