After I use the kv plugin to parse the log, I want to filter the value further. What should I do? my data look like below: level="2" treatment="3" cmd1="\"D:\Program Files (x86)\a\safe\modules\setup.exe\" /s /smartsilence" type="sys" the logstash config look like below: filter { if[type] == "s…

Oh, I see. If you don't use define a target field for the KV filter, any created field is automatically created in the event root level, which is probably what you want. You can then iterate over all keys like so : filter { if [type] == "syslog" { kv { source => "message" field_…

system (system) Closed October 12, 2018, 1:31am 8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
How to extract the data in the target to the root directory Logstash	1	503	October 9, 2018
Logstash KV parsing : k=field, v=value Logstash	5	498	June 6, 2018
Logstash Parsing - kv filter Logstash	3	925	December 18, 2017
Convert values in kv-pairs (using ruby filter) Logstash	5	1143	July 5, 2018
Convert values in kv-pairs Logstash	3	4113	July 6, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

How to use the ruby{} filter to loop through k,v pairs after use the kv{} filter?

Related topics