title: Retrieving RESTful GET parameters in logstash
body: <p>I am trying to get logstash to parse key-value pairs in an HTTP get request from my ELB log files.</p>
  
  <p>the request field looks like
  <code>http://aaa.bbb/get?a=1&amp;b=2</code></p>
  
  <p>I'd like there to be a field for <code>a</code> and <code>b</code> in the log line above, and I am having trouble figuring it out.</p>
  
  <p>My logstash conf (formatted for clarity) is below which does not load any additional key fields. I assume that I need to split off the address portion of the URI, but have not figured that out. </p>
  
  <pre><code>input {
      file {
          path =&gt; "/home/ubuntu/logs/**/*.log"
          type =&gt; "elb"
          start_position =&gt; "beginning"
          sincedb_path =&gt; "log_sincedb"
      }
  }
  filter {
      if [type] == "elb" {
          grok {
              match =&gt; [ "message", "%{TIMESTAMP_ISO8601:timestamp} 
  %{NOTSPACE:loadbalancer} %{IP:client_ip}:%{NUMBER:client_port:int}
  %{IP:backend_ip}:%{NUMBER:backend_port:int} 
  %{NUMBER:request_processing_time:float}
  %{NUMBER:backend_processing_time:float} 
  %{NUMBER:response_processing_time:float} 
  %{NUMBER:elb_status_code:int}
  %{NUMBER:backend_status_code:int} 
  %{NUMBER:received_bytes:int} %{NUMBER:sent_bytes:int} 
  %{QS:request}" ]
          }
          date {
              match =&gt; [ "timestamp", "ISO8601" ]
          }
          kv {
              field_split =&gt; "&amp;?"
              source =&gt; "request"
              exclude_keys =&gt; ["callback"]
          }
      }
  }
  
  
  output {
      elasticsearch { host =&gt; localhost }
  }
  </code></pre>