I’m trying to add a widget to my dashboard that ought to show terms users searched for on a WordPress site. All WP search requests can easily be filtered with the expression request: \/?s=* performed on the corresponding Apache access.log in the message field. However, every message is cut in pieces in its ‘quick values’-view and so I end up having top values like ‘200’ or ‘127.0.0.1’ (see below). Since off course only the actual search terms should show up, this widget would be of no use.
How would one get rid of every irrelevant string from the Apache messages like
127.0.0.1 - - [11/Aug/2017:10:58:20 +0200] "GET /?s=mysearchterm HTTP/1.1" 200 19113 "http://mycoolsite.com" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0" in order to just show the mysearchterm that I’m interested in? Should or can this be done with an extractor that filters these messages from the outset or is there another way to do this? Any ideas would be appreciated…