title: Extract Parameter (sub-string) from URL GROK Pattern
body: <p>I have ELK running for log analysis. I have everything working. There are just a few tweaks I would like to make. To all the ES/ELK Gods in stackoverflow, I'd appreciate any help on this. I'd gladly buy you a cup of coffee! :D</p>
  
  <p>Example:</p>
  
  <p>URL: /origina-www.domain.com/this/is/a/path?page=2</p>
  
  <p>First I would like to get the entire path as seen above.</p>
  
  <p>Second, I would like to get just the path before the parameter: /origina-www.domain.com/this/is/a/path</p>
  
  <p>Third, I would like to get just the parameter: ?page=2</p>
  
  <p>Fourth, I would like to make the timestamp on the logfile be the main time stamp on kibana. Currently, the timestamp kibana is showing is the date and time the ES was processed.</p>
  
  <p>This is what a sample entry looks like:</p>
  
  <pre><code>2016-10-19 23:57:32 192.168.0.1 GET /origin-www.example.com/url 200 1144 0 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" "-" "-"
  </code></pre>
  
  <p>Here's my config:</p>
  
  <pre><code>if [type] == "syslog" {
      grok {
        match =&gt; ["message", "%{IP:client}\s+%{WORD:method}\s+%{URIPATHPARAM:request}\s+%{NUMBER:bytes}\s+%{NUMBER:duration}\s+%{USER-AGENT}\s+%{QS:referrer}\s+%{QS:agent}%{GREEDYDATA}"]
            }
      date {
        match =&gt; [ "timestamp", "MMM dd, yyyy HH:mm:ss a" ]
        locale =&gt; "en"
      }   
  }
  </code></pre>
  
  <p>ES Version: 5.0.1
  Logstash Version: 5.0
  Kibana: 5.0</p>
  
  <p>UPDATE: I was actually able to solve it by using:</p>
  
  <pre><code>grok {
            match =&gt; ["message", "%{IP:client}\s+%{WORD:method}\s+%{URIPATHPARAM:request}\s+%{NUMBER:bytes}\s+%{NUMBER:duration}\s+%{USER-AGENT}\s+%{QS:referrer}\s+%{QS:agent}%{GREEDYDATA}"]
          }
          grok {
              match =&gt; [ "request", "%{GREEDYDATA:uri_path}\?%{GREEDYDATA:uri_query}" ]
          }
  
          kv {
              source =&gt; "uri_query"
              field_split =&gt; "&amp;"
              target =&gt; "query"
          }
  </code></pre>