# How to generate the field\_split\_pattern?

**URL:** <https://discuss.elastic.co/t/how-to-generate-the-field-split-pattern/127814>\
**Category:** Logstash\
**Created:** [April 12, 2018, 12:34pm UTC](https://discuss.elastic.co/t/how-to-generate-the-field-split-pattern/127814 "2018-04-12T12:34:21Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pinno\_Lin](https://avatars.discourse-cdn.com/v4/letter/p/aca169/32.png) [@Pinno\_Lin](https://discuss.elastic.co/u/Pinno_Lin)\
**Post date:** [April 12, 2018, 12:34pm UTC](https://discuss.elastic.co/t/how-to-generate-the-field-split-pattern/127814/1 "2018-04-12T12:34:22Z")

</div>

Hi,  
I want to make the filed\_split\_pattern in kv plugin, it's not like grok have some web site can let me try and error.

Agent\_Local\_Date="2018.03.26" Agent\_Local\_Time="2018/3/26 David 05:43:55" Computer\_Name="zootek\zoo02729\_NB" User\_Name="zootek\zoo02729" Application="outlook.exe" Operation="File Copy" Destination\_Drive\_Type="Fixed" Destination\_Directory="c:\users\zoo02729\appdata\local\microsoft\windows\temporary internet files\content.outlook\xdnprj13" IP\_Address="" Destination\_File="abc.bin" Detail\_File\_Size\_MB="0.06" Source\_Drive\_Type="Fixed" Source\_Directory="d:\72673 sec vd tcon guide\sec feedback makefile\0316" Source\_File="ksu\_n7a1\_sdc\_17y\_40\_f\_60hz\_8bit\_180315\_2018.03.15\_0.3\_e6e8.bin"

So Any way generate the pattern?? Thank a lot.

---

<div class="post-metadata">

**Author:** ![Pinno\_Lin](https://avatars.discourse-cdn.com/v4/letter/p/aca169/32.png) [@Pinno\_Lin](https://discuss.elastic.co/u/Pinno_Lin)\
**Post date:** [April 13, 2018, 2:24am UTC](https://discuss.elastic.co/t/how-to-generate-the-field-split-pattern/127814/2 "2018-04-13T02:24:45Z")

</div>

Sorry , I had fixed this problem.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 11, 2018, 2:25am UTC](https://discuss.elastic.co/t/how-to-generate-the-field-split-pattern/127814/3 "2018-05-11T02:25:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.