# How to parse values as key value not array

**URL:** <https://discuss.elastic.co/t/how-to-parse-values-as-key-value-not-array/342896>\
**Category:** Logstash\
**Created:** [September 13, 2023, 3:13am UTC](https://discuss.elastic.co/t/how-to-parse-values-as-key-value-not-array/342896 "2023-09-13T03:13:30Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dreambeam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dreambeam/32/125585_2.png) [@dreambeam](https://discuss.elastic.co/u/dreambeam)\
**Post date:** [September 13, 2023, 3:13am UTC](https://discuss.elastic.co/t/how-to-parse-values-as-key-value-not-array/342896/1 "2023-09-13T03:13:30Z")

</div>

Hi there. I am trying parse a text file containing values below.

```auto
15, 3241
16, 800
17, 1

```

Below if my logstash configuration. When I checked in Kibana , I have the field document displayed as a array.  
**"hcount": [800]**

My intention is to have the field as a key value not a array. Could you help ?  
**"count": 800**

200-filter.conf

```auto
filter {
if [log][file][path] =~"hourly"{
  grok { 
    match => "message" => "%{NUMBER:hour},%{NUMBER:count}" }
    add_field => { "hcount" => "%{count}" }
    add_tag => ["sit"]
 }
  mutate {
     convert => { "hcount" => "integer"}
}
}
}

```

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [September 13, 2023, 7:41am UTC](https://discuss.elastic.co/t/how-to-parse-values-as-key-value-not-array/342896/2 "2023-09-13T07:41:20Z")

</div>

Welcome to the community!

Most likely you have to recreate dataview in Kibana and use another index name, because during testing you send wrong data which has been recognized as array.  
This looks like csv, no need for grok, use csv plugin

```auto
filter {
  grok { match => {"message" => "%{NUMBER:hour}, %{NUMBER:count:int}" }
      add_field => { "hcount" => "%{count}" }
      add_tag => ["sit"]
  }
  mutate { convert => { "hcount" => "integer"} }

# another approach
  csv{
     columns => ["hour1","count1"]
     convert => { "count1" => "integer" }
	}

}

```

Result:

```auto
{
         "hour1" => "15",
        "count1" => 3241,
          "hour" => "15",
         "count" => 3241,
        "hcount" => 3241,
          "tags" => [
        [0] "sit"
    ]
}

```

---

<div class="post-metadata">

**Author:** ![dreambeam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dreambeam/32/125585_2.png) [@dreambeam](https://discuss.elastic.co/u/dreambeam)\
**Post date:** [September 26, 2023, 2:02pm UTC](https://discuss.elastic.co/t/how-to-parse-values-as-key-value-not-array/342896/3 "2023-09-26T14:02:17Z")

</div>

Thanks for the input.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 24, 2023, 2:03pm UTC](https://discuss.elastic.co/t/how-to-parse-values-as-key-value-not-array/342896/4 "2023-10-24T14:03:13Z")

</div>

Closed on October 24, 2023, 2:03pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.