Out logging contains all URLs that comes in to our server
Now in the full URL is in the "message" field
I would like to extract "orders" from "http://server/api/orders?"
This way I will be able to easily group by this when I do aggregation which would otherwise not be possible
Can this be done with elastic mapping ?
or does this have to happen before the mapping ?