# How to exclude key value pair from KV filter if Key size greater than 15 char
**URL:** https://discuss.elastic.co/t/how-to-exclude-key-value-pair-from-kv-filter-if-key-size-greater-than-15-char/269566
**Category:** Logstash
**Created:** [April 8, 2021, 9:04am UTC](https://discuss.elastic.co/t/how-to-exclude-key-value-pair-from-kv-filter-if-key-size-greater-than-15-char/269566 "2021-04-08T09:04:28Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)
#### Post date: [April 8, 2021, 9:04am UTC](https://discuss.elastic.co/t/how-to-exclude-key-value-pair-from-kv-filter-if-key-size-greater-than-15-char/269566/1 "2021-04-08T09:04:29Z")
We have log message which contain key value pairs and we are using KV filter to parse these data.
We need to exclude key value pair from KV filter if Key size greater than 15 char.
Need to exclude **[https://www.google.com](https://www.google.com)** key from below log events.
username: abc
password: 123
**[https://www.google.com](https://www.google.com)**: 2
```
kv {
source => kvmessage
value_split => ":"
}
```
Can any one suggest solution to exclude these key value pair?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 8, 2021, 3:49pm UTC](https://discuss.elastic.co/t/how-to-exclude-key-value-pair-from-kv-filter-if-key-size-greater-than-15-char/269566/2 "2021-04-08T15:49:19Z")
The kv filter cannot do that for you, you would have to use a ruby filter. I have not tested it but something like
```
ruby {
code => '
event.to_hash.each { |k, v|
if k.length > 15
event.remove(k)
end
}
'
}
```
---
### Author:  [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)
#### Post date: [April 9, 2021, 5:01am UTC](https://discuss.elastic.co/t/how-to-exclude-key-value-pair-from-kv-filter-if-key-size-greater-than-15-char/269566/3 "2021-04-09T05:01:42Z")
Can you please correct below code. not getting any error but still fields are created with char greater than 15.
else if "WEBAPPS" in [labels][kind] {
grok {
match =\> { "message" =\> "%{NUMBER:Year}-%{DATA:Month}-%{NOTSPACE:Day}\s\*%{NOTSPACE:Hour}:%{NOTSPACE:Minute}:%{NOTSPACE:Second}\s\*%{WORD:AppName}\s\*%{WORD:Loglevel}\s%{GREEDYDATA:kvmessage}" }
}
```
ruby {
code => '
event.to_hash.each { |k, v|
if k.length > 15
event.remove(k)
end
}
'
}
kv {
source => kvmessage
value_split => ":"
}
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 9, 2021, 3:13pm UTC](https://discuss.elastic.co/t/how-to-exclude-key-value-pair-from-kv-filter-if-key-size-greater-than-15-char/269566/4 "2021-04-09T15:13:35Z")
You cannot remove the fields if they do not exist. The ruby filter has to be after the kv filter that creates the fields.
---
### Author:  [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)
#### Post date: [April 9, 2021, 5:43pm UTC](https://discuss.elastic.co/t/how-to-exclude-key-value-pair-from-kv-filter-if-key-size-greater-than-15-char/269566/5 "2021-04-09T17:43:49Z")
@Badger ,
Thank you so much for your quick reply.
is it exclude particular key value pair or it exclude whole log line?
as per my log observation i am thinking it is dropping complete logline if he found key value is greater than 15. I need to drop that particular key value pair not complete log line
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 9, 2021, 5:56pm UTC](https://discuss.elastic.co/t/how-to-exclude-key-value-pair-from-kv-filter-if-key-size-greater-than-15-char/269566/6 "2021-04-09T17:56:25Z")
> [@mangeshmj1992](#):
>
> i am thinking it is dropping complete logline if he found key value is greater than 15
No, it just removes the key/value pair that has the long key.
---
### Author:  [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)
#### Post date: [April 9, 2021, 6:00pm UTC](https://discuss.elastic.co/t/how-to-exclude-key-value-pair-from-kv-filter-if-key-size-greater-than-15-char/269566/7 "2021-04-09T18:00:42Z")
@Badger ,
Yes it just removes key value pair. thank you so much for your help. it is working fine now. 🙂
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 7, 2021, 6:01pm UTC](https://discuss.elastic.co/t/how-to-exclude-key-value-pair-from-kv-filter-if-key-size-greater-than-15-char/269566/8 "2021-05-07T18:01:11Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.