# How add prefix to the fields using kv filter
**URL:** https://discuss.elastic.co/t/how-add-prefix-to-the-fields-using-kv-filter/238150
**Category:** Logstash
**Created:** [June 22, 2020, 8:33pm UTC](https://discuss.elastic.co/t/how-add-prefix-to-the-fields-using-kv-filter/238150 "2020-06-22T20:33:15Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@Ramalakshmi](https://discuss.elastic.co/u/Ramalakshmi)
#### Post date: [June 22, 2020, 8:33pm UTC](https://discuss.elastic.co/t/how-add-prefix-to-the-fields-using-kv-filter/238150/1 "2020-06-22T20:33:15Z")
Hi
I am adding prefix to the fields using kv filter, It's working to the some of the fields in the json message.
Example: Filed name is resource.network.imageid while adding prefix as aws.datasource using kv filter I got the output as aws.datasource.imageid but I want output as aws.datasource.resource.network.imageid.
In filter section I am using below kv filter
```
kv {
source => "message"
field_split_pattern => ".,"
value_split => ":"
prefix => "aws.datasource"
remove_char_key => "\"{"
remove_char_value => "\[{}[],\"]"
trim_key => "\"{"
trim_value => "\[{}[\*],\"]"
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 22, 2020, 8:40pm UTC](https://discuss.elastic.co/t/how-add-prefix-to-the-fields-using-kv-filter/238150/2 "2020-06-22T20:40:30Z")
Please edit your post, select the filter configuration, and click on \ in the toolbar. That will result in the configuration looking like
```
kv {
source => "message"
```
etc.
Can you show us what a message looks like in
```
output { stdout { codec => rubydebug } }
```
---
### Author:  [@Ramalakshmi](https://discuss.elastic.co/u/Ramalakshmi)
#### Post date: [June 22, 2020, 9:09pm UTC](https://discuss.elastic.co/t/how-add-prefix-to-the-fields-using-kv-filter/238150/3 "2020-06-22T21:09:44Z")
Hey Badger,
I am using the below configuration file.
```
input {
file {
path => "/root/logs.txt"
start_position => "beginning"
sincedb_path => "/tmp/csv"
}
}
}
filter {
json {
source => "message"
}
kv {
source => "message"
field_split_pattern => ".,\[^resource]"
value_split => ":"
prefix => "aws.datasource."
remove_char_key => "\"{"
remove_char_value => "\[{}[],\"]"
trim_key => "\"{"
trim_value => "\[{}[],\"]"
}
}
output {
elasticsearch {
hosts => ["xxxxxxxx:9200"]
index => "test-"
user => "xxxx"
password => "xxxx"
}
stdout { codec => rubydebug }
}
```
{"schemaVersion":"2.0","accountId":"345612345","region":"northeast-1","partition":"aws","id":"20456vghu90sders3a0b14a54f74d47","arn":"arn:aws:datasource:northeast-1:997405263248:detector/58b78d709b32f0224388a7bf82d44843/finding/20b8990ff15f880d93a0b14a54f74d47","type":"UnauthorizedAccess:IAMUser/ConsoleLogin","resource":{"resourceType":"AccessKey","accessKeyDetails":{"[accessKeyId":null,"principalId":"ARABRWNYSFGFSCGGGKCZTBH6:logstash@team.com](mailto:accessKeyId%22:null,%22principalId%22:%22ARABRWNYSFGFSCGGGKCZTBH6:logstash@team.com)","userType":"AssumedRole","userName":"logstash@team.com"}},"service":{"serviceName":"guardduty","detectorId":"58b78d709ub50scd23582d44843","action":{"actionType":"AWS\_API\_CALL","awsApiCallAction":{"api":"ConsoleLogin","serviceName":"[signin.amazonaws.com](http://signin.amazonaws.com)","callerType":"Remote IP","remoteIpDetails":{"ipAddressV4":"17.71.13.157","organization":{"asn":"0022","asnOrg":"COMCAST-7922","isp":"Comcast Cable"
The output Iam expecting
aws.datasource.service.action.actionType:AWS\_API\_CALL
aws.datasource.resource.resourcetype:Accesskey
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 22, 2020, 10:03pm UTC](https://discuss.elastic.co/t/how-add-prefix-to-the-fields-using-kv-filter/238150/4 "2020-06-22T22:03:00Z")
I don't think you can do that with a kv filter. However, the json filter will parse the JSON and you can then move the fields around. Either
```
mutate {
copy => {
"[service][action][actionType]" => "aws.datasource.service.action.actionType"
"[resource][resourceType]" => "aws.datasource.resource.resourcetype"
}
}
```
if you want field names with dots in them
```
mutate {
copy => {
"[service][action][actionType]" => "[aws][datasource][service][action][actionType]"
"[resource][resourceType]" => "[aws][datasource][resource][resourcetype]"
}
}
```
if you want fields nested in an object.
---
### Author:  [@Ramalakshmi](https://discuss.elastic.co/u/Ramalakshmi)
#### Post date: [June 23, 2020, 5:14am UTC](https://discuss.elastic.co/t/how-add-prefix-to-the-fields-using-kv-filter/238150/5 "2020-06-23T05:14:01Z")
You are saying that we can't use kv filter for nexted field in the data,you saying need to define aws.datasource manually but I want to add dynamically because I am getting so may fields. Is there any possibility to add dynamically.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 23, 2020, 1:37pm UTC](https://discuss.elastic.co/t/how-add-prefix-to-the-fields-using-kv-filter/238150/6 "2020-06-23T13:37:11Z")
You could use a ruby filter to iterate over the fields and rename them.
---
### Author:  [@Ramalakshmi](https://discuss.elastic.co/u/Ramalakshmi)
#### Post date: [June 23, 2020, 1:56pm UTC](https://discuss.elastic.co/t/how-add-prefix-to-the-fields-using-kv-filter/238150/7 "2020-06-23T13:56:39Z")
ok,I have tried with ruby code but I didn't get any output.Can you please provide code related to the adding prefix to the field.
---
### Author:  [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)
#### Post date: [November 30, 2021, 9:00am UTC](https://discuss.elastic.co/t/how-add-prefix-to-the-fields-using-kv-filter/238150/8 "2021-11-30T09:00:20Z")
you can try `target => "[aws][datasource]"` inside your kv filter
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 4, 2022, 8:03am UTC](https://discuss.elastic.co/t/how-add-prefix-to-the-fields-using-kv-filter/238150/9 "2022-11-04T08:03:28Z")