Hello! I'm trying to parse CheckPoint log which contains duplicated keys but with different values. For example ... match_id:"555"; match_id:"777"; ... When I use kv plugin kv { source => "message" field_split => ";" value_split => ":" trim_key => " " } I get something like match_id: 55…

How to parse duplicated keys with different values

Badger November 11, 2021, 4:33pm 2

Use a ruby filter. Something like this.

Topic		Replies	Views
Field with duplicate values, keep only one Logstash	1	410	December 11, 2019
Logstash parsing data incorrectly Logstash	3	153	April 9, 2024
How to parse values as key value not array Logstash	3	235	October 24, 2023
Logstash - Parsing fields with duplicate names Logstash	6	232	November 28, 2023
Nested key-values parsed with KV Logstash	6	450	January 2, 2021

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

How to parse duplicated keys with different values

Related Topics