# Separating request URI path and query in logstash

**URL:** https://discuss.elastic.co/t/separating-request-uri-path-and-query-in-logstash/159441
**Category:** Logstash
**Created:** [December 5, 2018, 1:29am UTC](https://discuss.elastic.co/t/separating-request-uri-path-and-query-in-logstash/159441 "2018-12-05T01:29:14Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![vkhaa](https://avatars.discourse-cdn.com/v4/letter/v/cdc98d/32.png) [@vkhaa](https://discuss.elastic.co/u/vkhaa)
#### Post date: [December 5, 2018, 1:29am UTC](https://discuss.elastic.co/t/separating-request-uri-path-and-query-in-logstash/159441/1 "2018-12-05T01:29:14Z")

</div>

All,

I'm new with Logstash so forgive me for this basic question. I'm trying to create a GROK filter to parse the following log lines.

```
GET /rest/api/latest/user/search?username=xxxxxx&etag=331231 HTTP/1.1
GET /status HTTP/1.1

```

I'm trying to break string /rest/api/latest/user/search?username=1565349 where string after '?' is optional.

Here is the best I can do which match the first string but not on the second

```
grok {
    match => {"message" => "%{WORD:method} %{NOTSPACE:req_url}\?%{NOTSPACE:req_param} %{NOTSPACE:protocol}
  }

```

Also, how to filter out "&etag=......." part from the logstash?

Any help is greatly appreciated.

---

<div class="post-metadata">

### Author: ![vkhaa](https://avatars.discourse-cdn.com/v4/letter/v/cdc98d/32.png) [@vkhaa](https://discuss.elastic.co/u/vkhaa)
#### Post date: [December 5, 2018, 2:27am UTC](https://discuss.elastic.co/t/separating-request-uri-path-and-query-in-logstash/159441/2 "2018-12-05T02:27:00Z")

</div>

Seems I found a solution.

Use KV filter to break down req\_url.

```
grok {
    match => {"message" => "%{WORD:method} %{NOTSPACE:req_url} %{NOTSPACE:protocol}
  }
  kv {
    source => "req_url"
    field_split => "?"
  }
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 2, 2019, 2:27am UTC](https://discuss.elastic.co/t/separating-request-uri-path-and-query-in-logstash/159441/3 "2019-01-02T02:27:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.