# Bug: KV filter does not handle quoted strings with spaces at the end of a line, when using windows line endings

**URL:** <https://discuss.elastic.co/t/bug-kv-filter-does-not-handle-quoted-strings-with-spaces-at-the-end-of-a-line-when-using-windows-line-endings/211916>\
**Category:** Logstash\
**Created:** [December 15, 2019, 5:13pm UTC](https://discuss.elastic.co/t/bug-kv-filter-does-not-handle-quoted-strings-with-spaces-at-the-end-of-a-line-when-using-windows-line-endings/211916 "2019-12-15T17:13:27Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ridago](https://avatars.discourse-cdn.com/v4/letter/r/a6a055/32.png) [@ridago](https://discuss.elastic.co/u/ridago)\
**Post date:** [December 15, 2019, 5:13pm UTC](https://discuss.elastic.co/t/bug-kv-filter-does-not-handle-quoted-strings-with-spaces-at-the-end-of-a-line-when-using-windows-line-endings/211916/1 "2019-12-15T17:13:27Z")

</div>

I've come accross an issue with the kv-filter plugin where if I input a file with windows line endings and the last key value pair on the line is a string with spaces, the string is not read correctly, but is instead read up until the first space, including the leading quotation mark. This only happens on lines that end with a line ending, so if there is no new line after the last line, this line will be read correctly.

- Version: Logstash 7.5.0, KV-filter 4.4.0
- Operating System: Debian 10
- Config File:

> input {  
> file {  
> path =\> "[path to input file]"  
> mode =\> "read"  
> start\_position =\> "beginning"  
> }  
> }  
> filter {  
> kv {   
> target =\> "log\_params"  
> }  
> }  
> output {  
> elasticsearch {  
> hosts =\> ["localhost:9200"]  
> }  
> }

- Sample Data:

> key1="string one one" key2=123 key3="string one two"  
> key1="string one two" key2=321 key3="string two two"

- Steps to Reproduce:  
Create two files with the above sample data, one with Unix line endings and one with Windows line endings. The Unix line endings file returns (only printing output of the first line to keep it short):

> log\_params.key1: string one one  
> log\_params.key2: 123  
> log\_params.key3: string one two

The Windows file endings file returns:

> log\_params.key1: string one one  
> log\_params.key2: 123  
> log\_params.key3: "string

edit1: typo

---

<div class="post-metadata">

**Author:** ![VietCong](https://avatars.discourse-cdn.com/v4/letter/v/e47774/32.png) [@VietCong](https://discuss.elastic.co/u/VietCong)\
**Post date:** [December 15, 2019, 8:19pm UTC](https://discuss.elastic.co/t/bug-kv-filter-does-not-handle-quoted-strings-with-spaces-at-the-end-of-a-line-when-using-windows-line-endings/211916/2 "2019-12-15T20:19:49Z")

</div>

didyou try telling the kv filter to use = as the key-value separator?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [December 15, 2019, 8:57pm UTC](https://discuss.elastic.co/t/bug-kv-filter-does-not-handle-quoted-strings-with-spaces-at-the-end-of-a-line-when-using-windows-line-endings/211916/3 "2019-12-15T20:57:47Z")

</div>

> [@ridago](#):
>
> kv {  
> target =\> "log\_params"  
> }

I don't think that is a bug, quoted fields have to start and end with quotes. So instead of taking "string one two" as a quoted field it consumes just the first word. Then the rest of the words do not have value separators, so they are dropped.

You can use

```
field_split => "^M "

```

(where ^M is a literal carriage return) to cause it to be a quoted string again.

---

<div class="post-metadata">

**Author:** ![ridago](https://avatars.discourse-cdn.com/v4/letter/r/a6a055/32.png) [@ridago](https://discuss.elastic.co/u/ridago)\
**Post date:** [December 16, 2019, 11:55am UTC](https://discuss.elastic.co/t/bug-kv-filter-does-not-handle-quoted-strings-with-spaces-at-the-end-of-a-line-when-using-windows-line-endings/211916/4 "2019-12-16T11:55:34Z")

</div>

Thanks for the clarification. I tried adding the field split, which worked on the test data. On my real world data it worked better than before, meaning a lot of the lines that were wrong before are now right. However, for some reason it didn't work on all lines. I'm not sure what other weird characters might have sneaked in on those lines, but in the end I just added a mutate filter and replaced every carriage return with nothing. This worked on every line.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 13, 2020, 12:00pm UTC](https://discuss.elastic.co/t/bug-kv-filter-does-not-handle-quoted-strings-with-spaces-at-the-end-of-a-line-when-using-windows-line-endings/211916/5 "2020-01-13T12:00:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.