# Adding prefex to the field extracted via KV plugin
**URL:** https://discuss.elastic.co/t/adding-prefex-to-the-field-extracted-via-kv-plugin/276621
**Category:** Logstash
**Created:** [June 22, 2021, 8:39am UTC](https://discuss.elastic.co/t/adding-prefex-to-the-field-extracted-via-kv-plugin/276621 "2021-06-22T08:39:19Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@frank\_rib](https://discuss.elastic.co/u/frank_rib)
#### Post date: [June 22, 2021, 8:39am UTC](https://discuss.elastic.co/t/adding-prefex-to-the-field-extracted-via-kv-plugin/276621/1 "2021-06-22T08:39:19Z")
Hello every body,
> Apr 1 15:00:01 pc-tst cft: 21/04/20 00:00:00 CFTC12I IDTU=A0007GK PART=LKOR STATE=Y PHASE=Y PHASESTEP=C DIRECT=S TYPE=F SENTINEL\_STATE=POST\_PROC Deleted
Is there a method to rename the fields extracted via the kv plugin by adding a prefex (example ctf): SENTINEL\_STATE by ctf.SENTINEL\_STATE?
Best regards,
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 22, 2021, 4:51pm UTC](https://discuss.elastic.co/t/adding-prefex-to-the-field-extracted-via-kv-plugin/276621/2 "2021-06-22T16:51:40Z")
You could do the rename in a ruby filter. I am not sure what condition you will need. An example would be
```
ruby {
code => '
event.to_hash.each { |k, v|
if k.match?(/[A-Z_]+/)
event.set("ctf.#{k}", v)
event.remove(k)
end
}
'
}
```
That will avoid renaming fields like @timestamp. If you want the fields nested in the ctf object then change that to use
```
event.set("[ctf][#{k}]", v)
```
If the set of fields you need to rename is fixed then you might want to use
```
if ["IDTU", "PART", "PHASE", ...].include? k
```
instead of the regexp.
---
### Author:  [@ErSumit](https://discuss.elastic.co/u/ErSumit)
#### Post date: [June 22, 2021, 5:26pm UTC](https://discuss.elastic.co/t/adding-prefex-to-the-field-extracted-via-kv-plugin/276621/3 "2021-06-22T17:26:52Z")
You can achieve with filter
```auto
kv {
source => "message"
field_split_pattern => " "
value_split => "="
prefix => "ctf"
}
}
```
make sure you are passing only part of string to kv filter
as:
IDTU=A0007GK PART=LKOR STATE=Y PHASE=Y PHASESTEP=C DIRECT=S TYPE=F SENTINEL\_STATE=POST\_PROC
Use dissect or grok parsing to separate the string for kv filter
Pls let us know if it works
Cheers!
---
### Author:  [@frank\_rib](https://discuss.elastic.co/u/frank_rib)
#### Post date: [June 23, 2021, 5:18pm UTC](https://discuss.elastic.co/t/adding-prefex-to-the-field-extracted-via-kv-plugin/276621/4 "2021-06-23T17:18:55Z")
Hello,
Thanks badger and ErSumit for your help, i tested the kv with the prefix and it worked
Best regards
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 21, 2021, 5:19pm UTC](https://discuss.elastic.co/t/adding-prefex-to-the-field-extracted-via-kv-plugin/276621/5 "2021-07-21T17:19:08Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.