Newbie question: different numbers of URL parameters

Hi,

I am new to to the ELK stack and managed to get the first data into elastic and perform some searches. Now I would like to work with some of my customized web server logs. Very probably this has been answered before, but as I am new the the whole topic I probably don't know the terms to find it - sorry if that's the case.

The logs have a structure which I put into a grok pattern:

\A%{TIMESTAMP_ISO8601} %{IP} %{USERNAME} %{HOSTNAME} %{WORD} %{URIPATH} %{NOTSPACE} %{NUMBER} %{NOTSPACE} %{NOTSPACE} %{NOTSPACE} %{NOTSPACE} %{NOTSPACE} %{NOTSPACE} %{NOTSPACE} %{NOTSPACE} %{NOTSPACE}

Now the first %{NOTSPACE} contains at least one ore more URL parameters like
?color=blue&number=56&weather=sunny

Would it be possible to have these extracted as separate fields whenever they occur? All of these parameters are name:value pairs, none of them is there all the time and the amount of them per log line can differ.

Thank you!

Hi there!

You could save this in some field and them apply kv filter to split those parameters.

https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html

Hope it helps.

Regards

Thank you, this sounds helpful. Looks like I have to pass another barrier first, after I have got the grok filter working I will extend it with kv.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.