# How to access nested message in logstash KV filter

**URL:** <https://discuss.elastic.co/t/how-to-access-nested-message-in-logstash-kv-filter/175087>\
**Category:** Logstash\
**Created:** [April 3, 2019, 2:18am UTC](https://discuss.elastic.co/t/how-to-access-nested-message-in-logstash-kv-filter/175087 "2019-04-03T02:18:02Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vincent\_Chen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vincent_chen/32/43352_2.png) [@Vincent\_Chen](https://discuss.elastic.co/u/Vincent_Chen)\
**Post date:** [April 3, 2019, 2:18am UTC](https://discuss.elastic.co/t/how-to-access-nested-message-in-logstash-kv-filter/175087/1 "2019-04-03T02:18:02Z")

</div>

Hi everyone,

I want to use KV filter to parse a nested message field, see below for my sample json:

```
  {
    "_index": "myindex",
    "_type": "doc",
    "_id": "myid",
    "_score": 5.339951,
    "_source": {
      "msg": "some msg",
      "message": "a=1, b=2, c=3, d=4"
    }
  }

```

And I tried using a kv filter like this

> kv {  
> source =\> "[\_source][message]"  
> value\_split =\> "="  
> field\_split =\> ",\s"  
> }

But this doesn't work. I also tried "\_source.message", "\_source.message.value" and "message" as the source, none of these work.

Any idea?

Many thanks.

Cheers,  
Vincent

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 3, 2019, 1:44pm UTC](https://discuss.elastic.co/t/how-to-access-nested-message-in-logstash-kv-filter/175087/2 "2019-04-03T13:44:06Z")

</div>

If that's the message your that logstash is receiving (which is unclear, since it looks like the output from an elasticsearch query, so it could be what you get after logstash writes to ES), then provided you have

```
filter { json { source => "message" } }

```

that kv filter should work.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 1, 2019, 1:44pm UTC](https://discuss.elastic.co/t/how-to-access-nested-message-in-logstash-kv-filter/175087/3 "2019-05-01T13:44:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.