# To extract fields from a query string

**URL:** <https://discuss.elastic.co/t/to-extract-fields-from-a-query-string/107680>\
**Category:** Logstash\
**Created:** [November 15, 2017, 7:34am UTC](https://discuss.elastic.co/t/to-extract-fields-from-a-query-string/107680 "2017-11-15T07:34:26Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![neal1991](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/neal1991/32/23178_2.png) [@neal1991](https://discuss.elastic.co/u/neal1991)\
**Post date:** [November 15, 2017, 7:34am UTC](https://discuss.elastic.co/t/to-extract-fields-from-a-query-string/107680/1 "2017-11-15T07:34:26Z")

</div>

Assume that there is a field like:

```auto
Cmd=FolderSync&User=ABC&DeviceId=androidc737881212&DeviceType=Android&Log=V141

```

I can use mutate to split the field into an array.  
it will just like ['Cmd=FolderSync....]  
But I want to convert the array to a json-like object like:

```auto
{
  “Cmd”: "FolderSync",
  ...
}

```

Or convert to fileds.  
Is there any way can do this?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 15, 2017, 7:37am UTC](https://discuss.elastic.co/t/to-extract-fields-from-a-query-string/107680/2 "2017-11-15T07:37:19Z")

</div>

Use a kv filter. Its documentation contains an example of exactly what you want to do.

---

<div class="post-metadata">

**Author:** ![neal1991](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/neal1991/32/23178_2.png) [@neal1991](https://discuss.elastic.co/u/neal1991)\
**Post date:** [November 15, 2017, 7:46am UTC](https://discuss.elastic.co/t/to-extract-fields-from-a-query-string/107680/3 "2017-11-15T07:46:18Z")

</div>

If kv conflicts with grok? Because I am trying to use grok parse the log. And then addressing the query field to jsonify.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 15, 2017, 12:17pm UTC](https://discuss.elastic.co/t/to-extract-fields-from-a-query-string/107680/4 "2017-11-15T12:17:56Z")

</div>

> If kv conflicts with grok?

It's not clear what you mean by this. Please give an example.

---

<div class="post-metadata">

**Author:** ![neal1991](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/neal1991/32/23178_2.png) [@neal1991](https://discuss.elastic.co/u/neal1991)\
**Post date:** [November 15, 2017, 12:45pm UTC](https://discuss.elastic.co/t/to-extract-fields-from-a-query-string/107680/5 "2017-11-15T12:45:23Z")

</div>

I have tried, it works. Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 13, 2017, 12:45pm UTC](https://discuss.elastic.co/t/to-extract-fields-from-a-query-string/107680/6 "2017-12-13T12:45:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.