I am using 'kv' filter in logstash like this
kv {
source => "request"
field_split => "&?"
}
I have a message like "key=value&key1=&key2=value2"
the logstash output is coming like this
"key" : "value"
"key1" : "&key2=value2"
But it should be like this
"key" : "value"
"key1" : ""
"key2" : "value2"
Can somebody suggest how can we achieve this?
Badger
December 12, 2019, 2:54pm
2
You could use default_keys to set the value of key1, but a kv filter parsing dynamic keys will not retain blank values.
I can not use default_keys because the real message is search query and it can be dynamic and contains any no of fields
system
(system)
Closed
January 9, 2020, 4:59pm
4
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.