# Help on case sensitive kv plugin
**URL:** https://discuss.elastic.co/t/help-on-case-sensitive-kv-plugin/96508
**Category:** Logstash
**Created:** [August 9, 2017, 8:32pm UTC](https://discuss.elastic.co/t/help-on-case-sensitive-kv-plugin/96508 "2017-08-09T20:32:50Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@bgardeamesta](https://discuss.elastic.co/u/bgardeamesta)
#### Post date: [August 9, 2017, 8:32pm UTC](https://discuss.elastic.co/t/help-on-case-sensitive-kv-plugin/96508/1 "2017-08-09T20:32:50Z")
Im using the kv plugin to extract some values from syslog messages such as From, to, call-ID, etc. Problem is that some logs come in capitalized and others don't and from what I can tell kv are case sensitive, any suggestions to solve this? here is the section of the code im using now
```
kv{
include_keys => ["Contact", "To", "From", "Call-ID"] # take syslog_message & look for keyvalues followed by ":" and parce them out
source => "syslog_message"
value_split => ":"
}
```
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 10, 2017, 6:11am UTC](https://discuss.elastic.co/t/help-on-case-sensitive-kv-plugin/96508/2 "2017-08-10T06:11:12Z")
Can't you just list both "Call-ID" and "call-ID" in `include_keys`?
---
### Author:  [@bgardeamesta](https://discuss.elastic.co/u/bgardeamesta)
#### Post date: [August 10, 2017, 3:38pm UTC](https://discuss.elastic.co/t/help-on-case-sensitive-kv-plugin/96508/3 "2017-08-10T15:38:11Z")
but when I do a search I would have to do two searches which is not ideal
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 11, 2017, 6:08am UTC](https://discuss.elastic.co/t/help-on-case-sensitive-kv-plugin/96508/4 "2017-08-11T06:08:54Z")
Sure, but you could rename the fields after the kv filter so the naming is consistent.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 8, 2017, 6:09am UTC](https://discuss.elastic.co/t/help-on-case-sensitive-kv-plugin/96508/5 "2017-09-08T06:09:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.