Is logstash required to parse url.query field into separate parts?

Elastic Stack Logstash
1

ELK 7.3 and Filebeat 7.3

I'm using the IIS module currently, and everything is parsing great. I would like to further parse the url.query section of this line. It is highlighted in bold.

2019-09-24 17:14:04 10.202.225.10 GET /Sso/Internal/SignOn.aspx fi=10_2084e051-0184-4746-a017-558fdf9a99a1&customer=3 443 - 10.202.225.254

I would like to separate it into 3 sections:

  1. fi=10 the underscore following this would be the delimiter. Title would be "Client"
  2. the middle section of stuff, the ampsersand being the delimiter. Title being "Widget"
  3. customer=3 would be the last section. Title being "Customer"

I'm using the built in IIS module, and am sending directly from filebeat to elasticsearch, no logstash. I don't know where to put this additional parsing language, or if I need to use logstash.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.