# Best approach to parse key value inside groups

**URL:** <https://discuss.elastic.co/t/best-approach-to-parse-key-value-inside-groups/90221>\
**Category:** Logstash\
**Created:** [June 21, 2017, 8:08am UTC](https://discuss.elastic.co/t/best-approach-to-parse-key-value-inside-groups/90221 "2017-06-21T08:08:49Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Laurent\_Barbisan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/laurent_barbisan/32/6725_2.png) [@Laurent\_Barbisan](https://discuss.elastic.co/u/Laurent_Barbisan)\
**Post date:** [June 21, 2017, 8:08am UTC](https://discuss.elastic.co/t/best-approach-to-parse-key-value-inside-groups/90221/1 "2017-06-21T08:08:49Z")

</div>

Hi,

We are starting using logstash intensively and now we have a very specific line of log to parse :

```auto
2017-06-16 13:17:59.156 [26] [Statistics] (INFO) category1:subcategory1[load=7%, physicalfree=11487488, swapfree=2490368, pagereads=21, pagewrites=0], category2:subcategory1[private=1417484, virtual=2271376, used=1305457, committed=1317048, reserved=1392324], category2:subcategory2[time=15%, count0=3389, count1=3155

```

So basicly I would use the kv plugin to parse key/value but then I need to add two fields (category & subcategory).

Is there any simple way to do this ?

Thanks for your help !

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [June 21, 2017, 8:12am UTC](https://discuss.elastic.co/t/best-approach-to-parse-key-value-inside-groups/90221/2 "2017-06-21T08:12:19Z")

</div>

Use grok to parse out the field ahead of the kv list, including category and subcategory, and the apply the kv filter to the appropriate field.

---

<div class="post-metadata">

**Author:** ![Laurent\_Barbisan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/laurent_barbisan/32/6725_2.png) [@Laurent\_Barbisan](https://discuss.elastic.co/u/Laurent_Barbisan)\
**Post date:** [June 21, 2017, 1:31pm UTC](https://discuss.elastic.co/t/best-approach-to-parse-key-value-inside-groups/90221/3 "2017-06-21T13:31:29Z")

</div>

Thanks !

In the end I end up with a ruby script

```auto
ruby {
			code => "
					statistic = event.get('statistics').split('], ')
					statistic.each {
						|categories|
							category, kv = categories.split('[')
							if !kv.nil? and !category.nil?
								kv.tr(']', '').split(',').each {
									|indicator|
									key, value = indicator.split('=')
									if !value.nil? and !key.nil?
										key = category.tr(':', '_') + '_' + key.tr(' ', '').tr(':', '_')
										value = value.tr('%','') 
										if value =~ (/\d+/)
											event.set(key, value.to_i)
										else
											event.set(key, value)
										end
									end
								}
							end
						}"
			}

```

it's not perfect, but it creates everything automatically and detect int vs string. Also to help me having every values in a document I've concatenated the category+subcat+key as the name of the field

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 19, 2017, 1:31pm UTC](https://discuss.elastic.co/t/best-approach-to-parse-key-value-inside-groups/90221/4 "2017-07-19T13:31:29Z")

</div>

Closed on July 19, 2017, 1:31pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.