# Changing the key of kv outout

**URL:** https://discuss.elastic.co/t/changing-the-key-of-kv-outout/362932
**Category:** Logstash
**Created:** [July 11, 2024, 7:25am UTC](https://discuss.elastic.co/t/changing-the-key-of-kv-outout/362932 "2024-07-11T07:25:14Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![sahere37](https://avatars.discourse-cdn.com/v4/letter/s/b2d939/32.png) [@sahere37](https://discuss.elastic.co/u/sahere37)
#### Post date: [July 11, 2024, 7:25am UTC](https://discuss.elastic.co/t/changing-the-key-of-kv-outout/362932/1 "2024-07-11T07:25:14Z")

</div>

hi , I have below kv filter in my logstash conf file

```auto
kv {
       field_split => " "
       value_split => "=""

   }

```

and my data is as bellow:

```auto
<12>d=2024-07 T=12:13 P=h c=12
<13>d=2024-07 T=12:15 P=l c=17
<102>d=2024-07 T=12:16 P=m c=19

```

using kv filter, data can be separated as following (for example for line1)

```auto
"<12>d" => "2024-07"
"T" => "12:13"
"P" => "h"
"c" => "12"

```

I want to define a unique name for the first fields of each line ( \<12\>d, \<13\>d, \<102\>d) as "date", how can i change the key name of kv output?

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [July 11, 2024, 12:39pm UTC](https://discuss.elastic.co/t/changing-the-key-of-kv-outout/362932/2 "2024-07-11T12:39:52Z")

</div>

Can you share your entire pipeline?

It is way easier to remove the `<XXX>` part before the `kv` filter, you can do that with a dissect filter.

```auto
dissect {
    mapping => {
        "message" => "<%{}>%{message}"
    }
}

```

This will overwritte your `message` field with just the kv part of the message.