How to use Ruby to preprocess k,v -pairs value

I`m new to Logstash and Ruby.
Would like to get help.
Currently I have a data as below

test:result testcase: #TEMP_BTWLAN:ok; loop:24;Temperature:28;

My initial target is by using ruby to generate as below Output.
test => result testcase
loop => 24
Temperature => 28

Below is my code
#using kv to split the message
kv {
source => "message"
field_split => ";"
value_split => ":"

ruby {
code => "
hash = event.to_hash
hash.each { |key, value|
if value.include? '"'
event.set(key, value.gsub!('"', ''))

Output as below:
test => result testcase: #TEMP_BTWLAN:ok <== Problem
loop => 24
Temperature => 28

How to solve Problem that I stated above?

Why is that a problem?

I know the result is behave like this -> test => result testcase: #TEMP_BTWLAN:ok

But my expected result as below
test => result testcase

Would like to get advise, how to perform second layer split by using ruby in order to meet my expected result?


Did you have tried to put a ; after testcase in your log ?
You can, if ou want, use grok :



Hi Cad,

Log Output ==> test:result testcase: #TEMP_BTWLAN:ok; loop:24;Temperature:28;

This log output is fixed which i not allowed to change.
The example you show is kv for grok?


This is my interpretation for kv. I don't know how the syntaxe is analysed but we can create a grok pattern with the same result.

This grok pattern signification is :
(?<key>[^:]+): = take all caracter while it is not a :, put it in "key" and after take :.
(?<value>[^;]+); = take all caracter while it is not a ;, put it in "value" and after take ;.

So you just have to duplicate this two pattern as many time as necessary.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.