# Is logstash required to parse url.query field into separate parts? **URL:** \ **Category:** Logstash\ **Created:** [October 3, 2019, 3:23pm UTC](https://discuss.elastic.co/t/is-logstash-required-to-parse-url-query-field-into-separate-parts/202202 "2019-10-03T15:23:54Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![antonio84](https://avatars.discourse-cdn.com/v4/letter/a/90ced4/32.png) [@antonio84](https://discuss.elastic.co/u/antonio84)\ **Post date:** [October 3, 2019, 3:23pm UTC](https://discuss.elastic.co/t/is-logstash-required-to-parse-url-query-field-into-separate-parts/202202/1 "2019-10-03T15:23:55Z")
ELK 7.3 and Filebeat 7.3 I'm using the IIS module currently, and everything is parsing great. I would like to further parse the url.query section of this line. It is highlighted in bold. > 2019-09-24 17:14:04 10.202.225.10 GET /Sso/Internal/SignOn.aspx **fi=10\_2084e051-0184-4746-a017-558fdf9a99a1&customer=3** 443 - 10.202.225.254 I would like to separate it into 3 sections: 1. fi=10 the underscore following this would be the delimiter. Title would be "Client" 2. the middle section of stuff, the ampsersand being the delimiter. Title being "Widget" 3. customer=3 would be the last section. Title being "Customer" **I'm using the built in IIS module, and am sending directly from filebeat to elasticsearch, no logstash.** I don't know where to put this additional parsing language, or if I need to use logstash. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 31, 2019, 3:23pm UTC](https://discuss.elastic.co/t/is-logstash-required-to-parse-url-query-field-into-separate-parts/202202/2 "2019-10-31T15:23:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.