# How to change my data to kv in Logstash

**URL:** <https://discuss.elastic.co/t/how-to-change-my-data-to-kv-in-logstash/257449>\
**Category:** Logstash\
**Created:** [December 3, 2020, 5:12am UTC](https://discuss.elastic.co/t/how-to-change-my-data-to-kv-in-logstash/257449 "2020-12-03T05:12:04Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mick1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mick1/32/80138_2.png) [@Mick1](https://discuss.elastic.co/u/Mick1)\
**Post date:** [December 3, 2020, 5:12am UTC](https://discuss.elastic.co/t/how-to-change-my-data-to-kv-in-logstash/257449/1 "2020-12-03T05:12:05Z")

</div>

The source data format cannot be changed

First stroke：  
{value=12123, key=ABC2}, {value=2223, key=AB21C}, {value=1243, key=A4B1C}, {value=15223, key=AB35C}, {value=122123, key=A24BC}, {value=122213, key=AB33C}, {value=223, key=AB34C}, {value=123, key=A1B2C}, {value=615223, key=A2BC3}, {value=12423, key=AB5C1}

Secord：  
{value=22323, key=AB21C}, {value=124, key=A4B1C}, {value=5223, key=AB35C}, {value=12223, key=A24BC}, {value=22153, key=AB33C}

How to change for kv format ，as follows  
ABC2=12123,AB21C=2223,A4B1C=1243,AB35C=15223,A24BC=122123,AB33C=122213,AB34C=223,A1B2C=123,A2BC3=615223,AB5C1=12423

Thanks for responding

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [December 3, 2020, 4:30pm UTC](https://discuss.elastic.co/t/how-to-change-my-data-to-kv-in-logstash/257449/2 "2020-12-03T16:30:14Z")

</div>

I would do that in ruby

```
    ruby {
        code => '
            m = event.get("message").scan(/value=(\w+), key=(\w+)/)
            s = ""
            m.each { |x|
                s += "#{x[1]}=#{x[0]},"
            }
            event.set("message", s.chomp(","))
        '
    }
```

---

<div class="post-metadata">

**Author:** ![Mick1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mick1/32/80138_2.png) [@Mick1](https://discuss.elastic.co/u/Mick1)\
**Post date:** [December 7, 2020, 2:09am UTC](https://discuss.elastic.co/t/how-to-change-my-data-to-kv-in-logstash/257449/3 "2020-12-07T02:09:03Z")

</div>

Thanks Badger , is solved

---

<div class="post-metadata">

**Author:** ![Mick1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mick1/32/80138_2.png) [@Mick1](https://discuss.elastic.co/u/Mick1)\
**Post date:** [December 7, 2020, 4:17am UTC](https://discuss.elastic.co/t/how-to-change-my-data-to-kv-in-logstash/257449/4 "2020-12-07T04:17:15Z")

</div>

Badger , i have other question

if key and value include - ( **dash** )

_Dashes appear randomly in Key and Value_

the source data like this  
{[value=app2.suint999.com](http://value=app2.suint999.com), key=X-CDN-ANDROID-NONE}, {[value=lt2.xfe1.com](http://value=lt2.xfe1.com), key=X-CDN-LT-AB-C}, {value=no-cache, key=Pragma}

Thanks for responding

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [December 7, 2020, 7:42pm UTC](https://discuss.elastic.co/t/how-to-change-my-data-to-kv-in-logstash/257449/5 "2020-12-07T19:42:35Z")

</div>

Try changing `/value=(\w+), key=(\w+)/` to `/value=([\w\-]+), key=([\w\-]+)/`

---

<div class="post-metadata">

**Author:** ![Mick1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mick1/32/80138_2.png) [@Mick1](https://discuss.elastic.co/u/Mick1)\
**Post date:** [December 8, 2020, 10:15am UTC](https://discuss.elastic.co/t/how-to-change-my-data-to-kv-in-logstash/257449/6 "2020-12-08T10:15:56Z")

</div>

> [@Badger](#):
>
> ```auto
> ruby {
> code => '
> m = event.get("message").scan(/value=(\w+), key=(\w+)/)
> s = ""
> m.each { |x|
> s += "#{x[1]}=#{x[0]},"
> }
> event.set("message", s.chomp(","))
> '
> }
> 
> ```

Badger , Thanks for your help  
This is great  
All solved

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 5, 2021, 10:15am UTC](https://discuss.elastic.co/t/how-to-change-my-data-to-kv-in-logstash/257449/7 "2021-01-05T10:15:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.