My message index field has field1=A big brown wolf, field2=Yet another furry animal, field3=No guarantee how many fields we will see This is what is indexed: field1=A field2=Yet field3=No I'm missing the rest of the words in between the = and the ',' This ends up in the message field What wou…

How to extract and transform unstructured data into fields

magnusbaeck (Magnus Bäck) July 5, 2017, 3:14pm 3

Can't you just set field_split => ","?

Topic		Replies	Views
How to Split the one field into multiple fields using kv plugins Logstash	5	2702	April 11, 2019
Logstash Parsing - kv filter Logstash	3	925	December 18, 2017
How to stop fields from kv filter splitting Logstash	3	330	March 21, 2019
KV Plugin Not working Logstash	9	714	August 27, 2019
Issues with kv filtering/ElasticSearch filtering Logstash	4	395	September 4, 2019

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

How to extract and transform unstructured data into fields

Related topics