# How to get kv filter to ignore value\_split in data
**URL:** https://discuss.elastic.co/t/how-to-get-kv-filter-to-ignore-value-split-in-data/115846
**Category:** Logstash
**Created:** [January 17, 2018, 7:59am UTC](https://discuss.elastic.co/t/how-to-get-kv-filter-to-ignore-value-split-in-data/115846 "2018-01-17T07:59:13Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Nofar](https://discuss.elastic.co/u/Nofar)
#### Post date: [January 17, 2018, 7:59am UTC](https://discuss.elastic.co/t/how-to-get-kv-filter-to-ignore-value-split-in-data/115846/1 "2018-01-17T07:59:14Z")
My conf file:
```
kv {
source => "cp_keyValueData"
field_split => ";"
value_split => ":"
trim_key => " "
}
```
data example:
```
key1: val1; key2: val2; key3: https://site/?g={......"...;%20%20CLR%20;%20rv:11.0)"..}; key4: val4;
```
it split to:
```
key1: val1
key2: val2;
key3: https://site/?g={......"...;%20%20CLR%20;
%20rv: 11.0)"..};
key4: val4;
```
How can i prevent this mistake?
There is some way to ignore value\_split that found in string?
thank u !
---
### Author:  [@Mojster](https://discuss.elastic.co/u/Mojster)
#### Post date: [January 17, 2018, 8:04am UTC](https://discuss.elastic.co/t/how-to-get-kv-filter-to-ignore-value-split-in-data/115846/2 "2018-01-17T08:04:39Z")
I've have had a similar problem.
My solution was to implement my own splitter in Ruby.
Here's my topic:
[How to handle '=' in values, splitting on | but KV takes over all '=' not only the first](https://discuss.elastic.co/t/how-to-handle-in-values-splitting-on-but-kv-takes-over-all-not-only-the-first/97851)
But as I see, you have a problem with pair split parameter';', mine was with key/value split parameter '='.
Hope you're can use mine as a waypoint.
---
### Author:  [@guyboertje](https://discuss.elastic.co/u/guyboertje)
#### Post date: [January 17, 2018, 11:58am UTC](https://discuss.elastic.co/t/how-to-get-kv-filter-to-ignore-value-split-in-data/115846/3 "2018-01-17T11:58:55Z")
Your issue is not with the `value_split`, it is with the `field_split` of `;`.
You have two options:
1. If your values are always percent encoded when it contains a `;` e.g. `https://site/?g={......"...;%20%20CLR%20;%20rv:11.0)"..}`, then inside the value you will never see `;` i.e. "semi-colon space" so you can make that your `field_split` value.
2. If your values are not percent encoded and contains a `;` then your only option is to use mutate gsub but not simply to replace the `;` because that will replace the semi-colon in the values too. You will need know all the possible keys and gsub for them but also to use a named pattern to capture the found key and substitute it back.
Example:
```auto
input {
generator {
message => 'key1: val1; key2: val2; key3: https://site/?g={......"...; CLR rv:11.0)"..}; key4: val4;'
count => 1
}
}
filter {
mutate {
gsub => ["[message]", ";\s*(?key1|key2|key3|key4)", '|^|\k']
}
kv {
field_split => "|^|"
value_split => ":"
source => "message"
}
}
output {
stdout {
codec => rubydebug {metadata => true}
}
}
```
Result:
```auto
{
"key1" => "val1",
"sequence" => 0,
"key2" => "val2",
"@timestamp" => 2018-01-17T11:57:10.574Z,
"key3" => "https://site/?g={......\"...; CLR rv:11.0)\"..}",
"key4" => "val4;",
"@version" => "1",
"host" => "Elastics-MacBook-Pro.local",
"message" => "key1: val1|^|key2: val2|^|key3: https://site/?g={......\"...; CLR rv:11.0)\"..}|^|key4: val4;"
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 14, 2018, 11:59am UTC](https://discuss.elastic.co/t/how-to-get-kv-filter-to-ignore-value-split-in-data/115846/4 "2018-02-14T11:59:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.