# Efficient kv parser - replacement?

**URL:** <https://discuss.elastic.co/t/efficient-kv-parser-replacement/253320>\
**Category:** Logstash\
**Created:** [October 26, 2020, 2:17pm UTC](https://discuss.elastic.co/t/efficient-kv-parser-replacement/253320 "2020-10-26T14:17:54Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![wedkarz014](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wedkarz014/32/48935_2.png) [@wedkarz014](https://discuss.elastic.co/u/wedkarz014)\
**Post date:** [October 26, 2020, 2:17pm UTC](https://discuss.elastic.co/t/efficient-kv-parser-replacement/253320/1 "2020-10-26T14:17:54Z")

</div>

Hi,  
In filter part I have a parser like here:

```
  kv {
    field_split => ","
    trim_value => "\""
    value_split => "="
    include_keys => ["Hostname","SlotId","EOCTimestamp","RequestStartTimestamp","ResponseStartTimestamp","AVRProfileName","VSName","POOLIP","POOLIPRouteDomain","POOLPort","URLString","ClientIP","ClientPort","MethodString","ResponseCode","GeoCode","ServerLatency","RequestSize","ResponseSize","RequestHeader","ResponseHeader","RequestPayload","RequestHeaderTruncated","ResponseHeaderTruncated","RequestPayloadTruncated","ResponsePayloadTruncated","MitigatedByDoSL7","RequestStartTimestampMicro","ResponseStartTimestampMicro","QualifiedForJSInjection","SessionId","BrowserName","OsName","ApplicationResponseTime","ClientTtfb","ClientSideNetworkLatency","ServerSideNetworkLatency","RequestDuration","ResponseDuration","ContentType","DeviceId","Referer","XffList","errdefs_msgno","Entity","AggrInterval","HitCount","VipName","ServerLatency","ServerLatencyHitCount","ClientConcurrentConns","ServerConcurrentConns","MaxClientConcurrentConns","MaxServerConcurrentConns","ClientNewConns","ServerNewConns","ServerNewConns","FailedConns","ExpiredConns","AbandonedConns","ClientBytesIn","ServerBytesOut","ServerBytesIn","ClientOutBytes","ClientPktsIn","ServerPktsOut","ServerPktsIn","ClientPktsOut","ConcurrentIps","ConcurrentBlockedIps","ConcurrentIpsParticipatingInAttacks","ConcurrentAttacks","ServerLatencyHealth","ConcurrentConnectionsHealth","ThroughputHealth","specialConcurrentIpsForAllVips"] }

```

I have about 300k-850k events in 15 minutes, when i use that parser cpu usage increases from 2 vcpu to 20-25vcpu and logstash loses some logs. Do you have any idea how I can improve the performance of this parser? change it to grok or use ruby?

Best,  
Patryk

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 23, 2020, 2:17pm UTC](https://discuss.elastic.co/t/efficient-kv-parser-replacement/253320/2 "2020-11-23T14:17:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.