# Filtering values with ruby in logstash 5.1
**URL:** https://discuss.elastic.co/t/filtering-values-with-ruby-in-logstash-5-1/87982
**Category:** Logstash
**Created:** [June 1, 2017, 8:35pm UTC](https://discuss.elastic.co/t/filtering-values-with-ruby-in-logstash-5-1/87982 "2017-06-01T20:35:28Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@harrigr](https://discuss.elastic.co/u/harrigr)
#### Post date: [June 1, 2017, 8:35pm UTC](https://discuss.elastic.co/t/filtering-values-with-ruby-in-logstash-5-1/87982/1 "2017-06-01T20:35:28Z")
So I have some data which is kv pairs separated by multiple characters, "::" to be precise. This issue: [https://github.com/logstash-plugins/logstash-filter-kv/issues/15](https://github.com/logstash-plugins/logstash-filter-kv/issues/15) shows that the built in kv filter cannot use multi-character key value splits. So I want to split on the first ":" and remove the second from the value field.
Example data:
`DATATYPE::SERVICEPERFDATA TIMET::1496348439 HOSTNAME::myhost SERVICEDESC::cpu_load SERVICEPERFDATA::load1=0.010;20.000;30.000;0; load5=0.040;15.000;25.000;0; load15=0.050;10.000;20.000;0; SERVICECHECKCOMMAND::check_cpu_load HOSTSTATE::UP HOSTSTATETYPE::HARD SERVICESTATE::OK SERVICESTATETYPE::HARD SERVICEOUTPUT::OK - load average: 0.01, 0.04, 0.05 HOSTGROUPNAMES::all`
Filter outline:
`kv { source => "message" field_split => "\t" value_split => ":" exclude_keys => ["type"] } # Remove colons from values, see https://github.com/logstash-plugins/logstash-filter-kv/issues/15 ruby { code => "event.to_hash.each { |k, v| if v.is_a? (String) event.set(k, v[1..-1]) if v.start_with? ':' end}" }`
However this code still returns values with the leading ":", any ideas why this is not working. As I said I have tried other similar permutations to this. What am I missing?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 29, 2017, 8:36pm UTC](https://discuss.elastic.co/t/filtering-values-with-ruby-in-logstash-5-1/87982/2 "2017-06-29T20:36:10Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.