# Filter KV
**URL:** https://discuss.elastic.co/t/filter-kv/201623
**Category:** Logstash
**Created:** [September 30, 2019, 11:36am UTC](https://discuss.elastic.co/t/filter-kv/201623 "2019-09-30T11:36:30Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@franco.federico](https://discuss.elastic.co/u/franco.federico)
#### Post date: [September 30, 2019, 11:36am UTC](https://discuss.elastic.co/t/filter-kv/201623/1 "2019-09-30T11:36:30Z")
I'm using KV to filter the data from the raw data from a firewall.
I have a field that sometimes has two values, and I'd like to keep only the first one.
How could I do to filter only the first one. I attach my filter. I try to use allow\_duplicate
```
kv {
# Note: values with spaces are lost (still getting there)
field_split => " "
trim_key => "<>\[\], "
trim_value => "<>\[\],"
# Only included the fields which are of interest (dont need everything)
allow_duplicate_values => false
include_keys => ["act","rt","spt","dpt","match_id","rule_action","ifname","dst","inzone","outzone","product","proto","service_id","src"]
```
And an example that has the problem (I'd like to remove the second value of match\_id, 16777237 )
`act=Accept app=HTTPS destinationTranslatedAddress=0.0.0.0 destinationTranslatedPort=0 deviceDirection=0 rt=1569794516000 sourceTranslatedAddress=xx.xx.xx.xx sourceTranslatedPort=0 spt=57172 dpt=443 cs2Label=Rule Name layer_name=BZ_MAIN_CLUSTER_NO_QOS Security layer_name=BZ_MAIN_CLUSTER_NO_QOS Application layer_uuid=6407ecb5-7913-4682-99f4-9d269e2c7642 layer_uuid=90819300-115c-4ee7-be1f-a7b7554ed0d1 match_id=242 match_id=16777237 parent_rule=0 parent_rule=0 rule_action=Accept rule_action=Accept rule_uid=d8ff3fb8-40be-4872-a863-b40b7c003f22 rule_uid=34106d8f-1fff-40aa-91b9-0aa6e2917274 conn_direction=Outgoing contextnum=1 ifname=eth3 logid=0 loguid={0x5d9129d3,0x80011,0xf919c152,0xc0000000} origin=xx.xxx.xx.xxx originsicname=CN\=it-boz-phoenix-fw1,O\=xxxxxx sequencenum=2 version=5 context_num=1 dst=xxx.xx.xx.xx hll_key=15255036334554928934 inzone=Internal nat_addtnl_rulenum=1 nat_rulenum=35 needs_browse_time=1 outzone=External product=xxxx proto=6 service_id=xxxx sig_id=4 src=10.62.1.67`
Thank you
Franco
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 30, 2019, 2:16pm UTC](https://discuss.elastic.co/t/filter-kv/201623/2 "2019-09-30T14:16:46Z")
```
if [match_id][0] { mutate { replace => { "match_id" => "%{[match_id][0]}" } } }
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 28, 2019, 2:22pm UTC](https://discuss.elastic.co/t/filter-kv/201623/3 "2019-10-28T14:22:20Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.