We are imported Nginx logs to elastic by Logstash to make an analytics panel in Kibana.
We need to make a filter to filter results based on campaign ids that the user started to reach our app.
As an example, a user comes to our app by "url?refid=reddit" by IP address x.x.x.x. the "?refid=reddit" get removed from the URL that passed to the browser by Nginx. user will continue using our app and answer a poll, that makes a request to our API but without "?refid=reddit". It logged into Nginx log like "/api/poll//answered". So, in this line of log, we don't know the campaign. but we have IP address of the user.
In Kibana we want to filter "/api/poll//answered" urls that started from our campaigns (e.g. reddit).
What is the best way to make it in Kibana? (or Logstash)