# Grok pattern
**URL:** https://discuss.elastic.co/t/grok-pattern/317891
**Category:** Logstash
**Created:** [November 1, 2022, 1:05pm UTC](https://discuss.elastic.co/t/grok-pattern/317891 "2022-11-01T13:05:37Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@abkonred1](https://discuss.elastic.co/u/abkonred1)
#### Post date: [November 1, 2022, 1:05pm UTC](https://discuss.elastic.co/t/grok-pattern/317891/1 "2022-11-01T13:05:37Z")
Hi Team,
I need to ingest the below log file, and i required all the fields without pipe. In order to create visualization and dashboards for the same. kindly any one please help, how to split the fields with this log event.
time=1666400383|hostname=XXXXXX|product=Firewall|layer\_name=GLOABAL|layer\_uuid=f978f8cb-69e7-4f2b-a4ef-ed3e6bbded54|match\_id=143|parent\_rule=0|rule\_action=Accept|rule\_name=95.49\_._._|rule\_uid=6541202c-dfbb-4c4e-8c27-d10d63c55f0d|action=Accept|conn\_direction=Outgoing|ifdir=inbound|ifname=bond3.3533|logid=0|loguid={0x685b2ca2,0x533605dd,0x4f6aaf1b,0xf009f746}|origin=10.174.129.129|sequencenum=538|time=1666400383|version=5|\_\_policy\_id\_tag=product=VPN-1 & FireWall-1db\_tag={1586140B-88A8-014F-A33B-6599BBD71827}|mgmt=usfwtamer01|date=1666357943|policy\_name=AMERICAS-GDC-EXT|dst=149.154.167.51|lastupdatetime=1666400383|log\_delay=1666400383|member\_id=1\_2|nat\_addtnl\_rulenum=0|nat\_rule\_uid=e7099cb0-b0ba-421a-91a3-b2990dee6e7d|nat\_rulenum=1668|proto=6|s\_port=51939|service=443|service\_id=gTCP-Groove-443|src=10.112.195.14|xlatedport=0|xlatedst=0.0.0.0|xlatesport=45957|xlatesrc=199.49.20.51
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [November 1, 2022, 2:33pm UTC](https://discuss.elastic.co/t/grok-pattern/317891/2 "2022-11-01T14:33:07Z")
You do not need to use grok with this, you need to use the `kv` filter and configure the field split to use the pipe character.
This filter will parse your message.
```auto
kv {
source => "message"
field_split => "|"
value_split => "="
}
```
---
### Author:  [@abkonred1](https://discuss.elastic.co/u/abkonred1)
#### Post date: [November 1, 2022, 3:16pm UTC](https://discuss.elastic.co/t/grok-pattern/317891/3 "2022-11-01T15:16:18Z")
Ok Thanks for your prompt response.
Do we need to install kV filter or will it be available by default. Am using logstash 7.16.3 version on RHEL 7 OS . Let me know, how to install the plugin if required additionally.
---
### Author:  [@ahmed\_charafouddine](https://discuss.elastic.co/u/ahmed_charafouddine)
#### Post date: [November 1, 2022, 3:59pm UTC](https://discuss.elastic.co/t/grok-pattern/317891/4 "2022-11-01T15:59:25Z")
it seems to me that the kv plugin is installed by default.
> **[Kv filter plugin | Logstash Reference \[7.16\] | Elastic](https://www.elastic.co/guide/en/logstash/7.16/plugins-filters-kv.html)**
---
### Author:  [@abkonred1](https://discuss.elastic.co/u/abkonred1)
#### Post date: [November 2, 2022, 7:25am UTC](https://discuss.elastic.co/t/grok-pattern/317891/5 "2022-11-02T07:25:06Z")
@leandrojmp Thank you very much..it got worked.
If I need the fields specifically, for example "product" and "version" fields. what will be the best approach?
time=5666373355|hostname=uspilrapfwmlog5|product=System Monitor|ifdir=inbound|ifname=daemon|loguid={0x6355d6e9,0x0,0x8585ae0a,0x55955755}|origin=50.575.58.538|sequencenum=5|time=5666373355|version=5|sys\_message:=installed defaultfilter
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 30, 2022, 7:25am UTC](https://discuss.elastic.co/t/grok-pattern/317891/6 "2022-11-30T07:25:32Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.