Your keyword search is still too broad; only certain messages are of interest.
Use the where operator to filter the results of a search. For example, to find URLs containing "search," use
*| parse "GET * " as url
| where url matches "*search*"
The where operator selects log messages that meet specific criteria. In the example, the "*" operator matches all log messages. The parse operator, described in more detail in the next section, extracts a url from each log message. To focus only on the messages we want, we use the where operator and the Boolean expression
matches "*search*". Only log messages for which the Boolean expression is true—that is, the extracted url includes search—will appear in the results.