# Grok expression for name value pairs

**URL:** <https://discuss.elastic.co/t/grok-expression-for-name-value-pairs/118703>\
**Category:** Logstash\
**Created:** [February 6, 2018, 6:47pm UTC](https://discuss.elastic.co/t/grok-expression-for-name-value-pairs/118703 "2018-02-06T18:47:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dushyanth\_Bn](https://avatars.discourse-cdn.com/v4/letter/d/90ced4/32.png) [@Dushyanth\_Bn](https://discuss.elastic.co/u/Dushyanth_Bn)\
**Post date:** [February 6, 2018, 6:47pm UTC](https://discuss.elastic.co/t/grok-expression-for-name-value-pairs/118703/1 "2018-02-06T18:47:50Z")

</div>

06 Feb 2018 13:11:24,640 INFO SaveMetrics:39 - Metrics :httpsessions.max -1 httpsessions.active 0 datasource.primary.active 0 datasource.primary.usage 0.0 datasource.hcarsessioninfo.active 0 datasource.hcarsessioninfo.usage 0.0 datasource.vhcpdemo.active 0 datasource.vhcpdemo.usage 0.0 mem 752313 mem.free 193712 processors 8 instance.uptime 153121 uptime 233225 systemload.average -1.0 heap.committed 624640 heap.init 262144 heap.used 430927 heap 3708416 nonheap.committed 133080 nonheap.init 2496 nonheap.used 127673 nonheap 0 threads.peak 125 threads.daemon 19 threads.totalStarted 145 threads 122 classes 13958 classes.loaded 13958 classes.unloaded 0 gc.ps\_scavenge.count 15 gc.ps\_scavenge.time 347 gc.ps\_marksweep.count 3 gc.ps\_marksweep.time 545

I have the above log commnets.  
I need to filter it by name value pairs for example

{  
"Timestamp": [  
[  
"06 Feb 2018 13:11:24,640"  
]  
],  
"loglevel": [  
[  
"INFO"  
]  
],  
"httpsessions.max": [  
[  
-1  
]  
],  
"httpsessions.active": [  
[  
0  
]  
]  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 6, 2018, 9:39pm UTC](https://discuss.elastic.co/t/grok-expression-for-name-value-pairs/118703/2 "2018-02-06T21:39:19Z")

</div>

Doing this with a grok filter will be tedious and error-prone. Try using a kv filter instead.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 6, 2018, 9:39pm UTC](https://discuss.elastic.co/t/grok-expression-for-name-value-pairs/118703/3 "2018-03-06T21:39:39Z")

</div>

Closed on March 6, 2018, 9:39pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.