# How to trim zero or more leading and trailing spaces from key-value pairs?
**URL:** https://discuss.elastic.co/t/how-to-trim-zero-or-more-leading-and-trailing-spaces-from-key-value-pairs/117933
**Category:** Logstash
**Created:** [February 1, 2018, 5:37am UTC](https://discuss.elastic.co/t/how-to-trim-zero-or-more-leading-and-trailing-spaces-from-key-value-pairs/117933 "2018-02-01T05:37:43Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@jainbhavya53](https://discuss.elastic.co/u/jainbhavya53)
#### Post date: [February 1, 2018, 5:37am UTC](https://discuss.elastic.co/t/how-to-trim-zero-or-more-leading-and-trailing-spaces-from-key-value-pairs/117933/1 "2018-02-01T05:37:43Z")
I have used `kv filter` to extract key-value pairs using `field_split` and have used default\_keys to provide default keys in case no value is present corresponding to that field.I have used strip of mutate filter to trim all the spaces from the values of the fields.
But for the same field I am getting two different fields one with the default values(that I mentioned using default\_keys) and another field with spaces.
I have tried different regex patterns for one or more spaces to be used in trim\_key like
```
"\s", "\s*" , "[]{1,}
```
but nothing worked
My kv filter looks like:--
```
kv {
source => "kvpairs"
default_keys => ["loc","0",
"time","null",
"action","null",
"orig","null"]
field_split => "|"
trim_key => "[]{1,}"
}
```
My log data looks like:---
```
loc=1810756|time= 23Jan2018 12:16:52|action=accept|orig=11.12.13.14|
loc =|time= 23Jan2018 12:16:52|action=accept|orig=11.12.13.14|
loc= |time= 23Jan2018 12:16:52|action=accept|orig=11.12.13.14|
loc = 2 | time = 23Jan2018 12:16:52 | action = accept |orig=11.12.13.14|
loc=3|time= 23Jan2018 12:16:52|action=accept|orig=11.12.13.14|
loc=7|time= 23Jan2018 12:16:52| action = |orig=11.12.13.14|
loc=8|time= 23Jan2018 12:16:52| action = |orig=11.12.13.14|
loc=9|time= 23Jan2018 12:16:52| action =|orig=11.12.13.14|
loc=10|time= 23Jan2018 12:16:52|action=accept| orig = 11.12.13.14 |
loc=11|time= 23Jan2018 12:16:52|action=accept|orig= |
loc=12|time= 23Jan2018 12:16:52|action=accept|orig= |
loc=13|time= 23Jan2018 12:16:52| action = accept |orig=|
loc=14|time= 23Jan2018 12:16:52| action = accept |orig=11.12.13.14|
loc=15|time= 23Jan2018 12:16:52|action=accept|orig=11.12.13.14|
loc=16|time= 23Jan2018 12:16:52|action=accept|orig=11.12.13.14|
```
The output that I should I get in
```
Case1:When value is not present,e.g action =|
should be -> "action" = "null"
Case2:When one or more spaces are present,e.g. action = |
should be -> "action" = " "
```
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [February 1, 2018, 6:25am UTC](https://discuss.elastic.co/t/how-to-trim-zero-or-more-leading-and-trailing-spaces-from-key-value-pairs/117933/2 "2018-02-01T06:25:34Z")
Why not use a mutate gsub filter first to 'fix' the field. Something like this might work:
```auto
input {
generator {
lines => [' a = 23 | b = spaced string ']
count => 1
}
}
filter {
mutate {
gsub => [
"message", "^\s*", "",
"message", "\s*$", "",
"message", "\s*=\s*", "=",
"message", "\s*\|\s*", "|"
]
}
kv {
field_split => "|"
}
}
output {
stdout { codec => rubydebug }
}
```
---
### Author:  [@jainbhavya53](https://discuss.elastic.co/u/jainbhavya53)
#### Post date: [February 1, 2018, 6:29am UTC](https://discuss.elastic.co/t/how-to-trim-zero-or-more-leading-and-trailing-spaces-from-key-value-pairs/117933/3 "2018-02-01T06:29:45Z")
So this will only remove the leading and trailing spaces in the key value [pairs.Am](http://pairs.Am) I correct??
And can you please explain me the gsub filter part.
Thanks in advance
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [February 1, 2018, 6:31am UTC](https://discuss.elastic.co/t/how-to-trim-zero-or-more-leading-and-trailing-spaces-from-key-value-pairs/117933/4 "2018-02-01T06:31:02Z")
The first two remove leading and trailing spaces in the field. The last two remove spaces around the separators.
---
### Author:  [@jainbhavya53](https://discuss.elastic.co/u/jainbhavya53)
#### Post date: [February 1, 2018, 6:32am UTC](https://discuss.elastic.co/t/how-to-trim-zero-or-more-leading-and-trailing-spaces-from-key-value-pairs/117933/5 "2018-02-01T06:32:48Z")
Thanks that helped a lot.
Any idea why is `trim_key` not working?
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [February 1, 2018, 6:40am UTC](https://discuss.elastic.co/t/how-to-trim-zero-or-more-leading-and-trailing-spaces-from-key-value-pairs/117933/6 "2018-02-01T06:40:09Z")
I don't know. Might be a bug.
---
### Author:  [@jainbhavya53](https://discuss.elastic.co/u/jainbhavya53)
#### Post date: [February 1, 2018, 6:46am UTC](https://discuss.elastic.co/t/how-to-trim-zero-or-more-leading-and-trailing-spaces-from-key-value-pairs/117933/7 "2018-02-01T06:46:19Z")
@Christian_Dahlqvist the `gsub` `regex` is not removing spaces around `=`.
---
### Author:  [@jainbhavya53](https://discuss.elastic.co/u/jainbhavya53)
#### Post date: [February 1, 2018, 6:51am UTC](https://discuss.elastic.co/t/how-to-trim-zero-or-more-leading-and-trailing-spaces-from-key-value-pairs/117933/8 "2018-02-01T06:51:22Z")
Oh I got the mistake
```
"message", "\s*=\s*/", "=",
```
should be:---
```
input {
generator {
lines => [' a = 23 | b = spaced string ']
count => 1
}
}
filter {
mutate {
gsub => [
"message", "^\s*", "",
"message", "\s*$", "",
"message", "\s*=\s*", "=",
"message", "\s*\|\s*", "|"
]
}
kv {
field_split => "|"
}
}
output {
stdout { codec => rubydebug }
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 1, 2018, 6:51am UTC](https://discuss.elastic.co/t/how-to-trim-zero-or-more-leading-and-trailing-spaces-from-key-value-pairs/117933/9 "2018-03-01T06:51:26Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.