# I want Message values as feild using logstash
**URL:** https://discuss.elastic.co/t/i-want-message-values-as-feild-using-logstash/303519
**Category:** Logstash
**Created:** [April 28, 2022, 1:31pm UTC](https://discuss.elastic.co/t/i-want-message-values-as-feild-using-logstash/303519 "2022-04-28T13:31:00Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)
#### Post date: [April 28, 2022, 1:31pm UTC](https://discuss.elastic.co/t/i-want-message-values-as-feild-using-logstash/303519/1 "2022-04-28T13:31:00Z")
Hello Every One
Following is my message I want to split message value and add as field for filter and visulize
how can I achive that please help any one
message
url=&type=click&date\_time=2013-01-01+12:00:00&initiated\_by=admin&initiated\_from=admin&list=1&campaign[id]=98&contact[id]=42&contact[email]=test@test.com&contact[first\_name]=First&contact[last\_name]=Last&contact[ip]=127.0.0.1&contact[fields][39]=custom+field+value&link[id]=754&link[url]=http://example.com
This is Logstash Config
input {
http {
host =\> "0.0.0.0"
port =\> 0000
}
}
```
filter {
urldecode {
all_fields => true
```
}
}
output {
Elasticsearch {
hosts =\> ['[https://x.x.x.x:9200](https://x.x.x.x:9200)' ]
user =\> 'user'
password =\> 'pass'
ssl =\> "true"
ssl\_certificate\_verification =\> "false"
index =\> "\_test"
}
stdout {
codec =\> "json"
}
}
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 28, 2022, 4:45pm UTC](https://discuss.elastic.co/t/i-want-message-values-as-feild-using-logstash/303519/2 "2022-04-28T16:45:16Z")
Please do not post pictures of text, they are hard to read, impossible to search, and cannot be used to reproduce the issue (and find a solution).
---
### Author:  [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)
#### Post date: [April 28, 2022, 5:08pm UTC](https://discuss.elastic.co/t/i-want-message-values-as-feild-using-logstash/303519/3 "2022-04-28T17:08:48Z")
Thank you for prompt reply @Badger
Actually this picture is related to my message output is there any solution for the same? Are got my point? and edited post with text please suggest if you have a any solution
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 28, 2022, 5:42pm UTC](https://discuss.elastic.co/t/i-want-message-values-as-feild-using-logstash/303519/4 "2022-04-28T17:42:22Z")
urldecode is used to undo url encoding, like replacing %20 with a space. It sounds like you want a [kv](https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html) filter. You could try
```
mutate { gsub => ["message", "\]", "}", "message", "\[", "{"] }
kv { field_split => "&" allow_empty_values => true }
```
You cannot have a field called "link[url]". That will result in an Invalid FieldReference exception.
---
### Author:  [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)
#### Post date: [April 28, 2022, 5:54pm UTC](https://discuss.elastic.co/t/i-want-message-values-as-feild-using-logstash/303519/5 "2022-04-28T17:54:22Z")
@Badger
**This is current Configuration**
input {
http {
host =\> "0.0.0.0" #
port =\> 0000
}
}
```
filter {
mutate { gsub => ["message", "\]", "}", "message", "\[", "{"] }
kv { field_split => "&" allow_empty_values => true }
```
}
output {
Elasticsearch {
hosts =\> ['[https://es:9200](https://es:9200)' ]
user =\> 'user'
password =\> 'pass'
ssl =\> "true"
ssl\_certificate\_verification =\> "false"
index =\> "crm\_webhook\_test"
}
stdout {
codec =\> "json"
}
}
**Getting following error**
2022-04-28T17:53:08,904][INFO][logstash.runner] Logstash shut down.
[2022-04-28T17:53:23,351][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"7.1.1"}
[2022-04-28T17:53:25,077][ERROR][logstash.filters.kv] Unknown setting 'allow\_empty\_values' for kv
[2022-04-28T17:53:25,085][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Something is wrong with your configuration.", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/config/mixin.rb:86:in `config_init'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:126:in `initialize'", "org/logstash/plugins/PluginFactoryExt.java:78:in `filter_delegator'", "org/logstash/plugins/PluginFactoryExt.java:248:in `plugin'", "org/logstash/execution/JavaBasePipelineExt.java:50:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:23:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:36:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:325:in `block in converge\_state'"]}
[2022-04-28T17:53:25,457][INFO][logstash.runner] Logstash shut down.
[2022-04-28T17:53:40,827][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"7.1.1"}
[2022-04-28T17:53:42,992][ERROR][logstash.filters.kv] Unknown setting 'allow\_empty\_values' for kv
[2022-04-28T17:53:43,003][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Something is wrong with your configuration.", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/config/mixin.rb:86:in `config_init'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:126:in `initialize'", "org/logstash/plugins/PluginFactoryExt.java:78:in `filter_delegator'", "org/logstash/plugins/PluginFactoryExt.java:248:in `plugin'", "org/logstash/execution/JavaBasePipelineExt.java:50:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:23:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:36:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:325:in `block in converge\_state'"]}
[2022-04-28T17:53:43,403][INFO][logstash.runner] Logstash shut down.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 28, 2022, 6:16pm UTC](https://discuss.elastic.co/t/i-want-message-values-as-feild-using-logstash/303519/6 "2022-04-28T18:16:54Z")
> [@dharminfadia](#):
>
> Unknown setting 'allow\_empty\_values' for kv
allow\_empty\_values was added in [8.1.0](https://www.elastic.co/guide/en/logstash/current/logstash-8-1-0.html). You can remove it from your configuration but then you will not get a [url] field from `url=&`.
---
### Author:  [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)
#### Post date: [April 29, 2022, 4:33am UTC](https://discuss.elastic.co/t/i-want-message-values-as-feild-using-logstash/303519/7 "2022-04-29T04:33:43Z")
\*\*@Badger \*\*
**Thank you Sir for Prompt reply my issue is resolve and really appriciate your time and Kind of support really Thanks Sir**
---
### Author:  [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)
#### Post date: [April 29, 2022, 8:06am UTC](https://discuss.elastic.co/t/i-want-message-values-as-feild-using-logstash/303519/8 "2022-04-29T08:06:50Z")
@Badger
i have one Other quetsion after getting proper splite message custome feild is showing inproper data can you Help me for the same ?
@timestamp Apr 29, 2022 @ 12:36:38.313
@version 1
\_id 3qsjdIAB3FWXhrhZyUAg
\_index crm\_webhook\_test
\_score -
\_type \_doc
campaign{id} 57
contact{email} [test@test.com](mailto:test@test.com)
contact{fields}{39} custom+field+value
contact{first\_name} First
contact{id} 42
contact{ip} 127.0.0.1
contact{last\_name} Last
date\_time 2013-01-01+12:00:00
event.original url=&type=unsubscribe&date\_time=2013-01-01+12:00:00&initiated\_by=admin&initiated\_from=admin&list=1&form[id]=1004&campaign[id]=57&unsubscribe[reason]=My+interests+are+changing&contact[id]=42&contact[email]=test@test.com&contact[first\_name]=First&contact[last\_name]=Last&contact[ip]=127.0.0.1&contact[fields][39]=custom+field+value
form{id} 1004
host.ip 0.0.0.0
http.method POST
http.request.body.bytes 375
http.request.mime\_type application/x-www-form-urlencoded
http.version HTTP/1.1
initiated\_by admin
initiated\_from admin
list 1
message url=&type=unsubscribe&date\_time=2013-01-01+12:00:00&initiated\_by=admin&initiated\_from=admin&list=1&form{id}=1004&campaign{id}=57&unsubscribe{reason}=My+interests+are+changing&contact{id}=42&contact{email}=test@test.com&contact{first\_name}=First&contact{last\_name}=Last&contact{ip}=127.0.0.1&contact{fields}{39}=custom+field+value
type unsubscribe
unsubscribe{reason} My+interests+are+changing
url
Contact field value and unsubscribe field value is now showing proper
---
### Author:  [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)
#### Post date: [April 29, 2022, 11:59am UTC](https://discuss.elastic.co/t/i-want-message-values-as-feild-using-logstash/303519/9 "2022-04-29T11:59:32Z")
This is issue is solved using split and joint mutate
Now I have another question to @Badger I am using OpenSearch Elasticsearch version
and if I am using Logstash 8.1 for KV filter How can I send Data to My Opensearch You have any idea ? please help for the same.
Thanks in Advance
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 29, 2022, 11:59am UTC](https://discuss.elastic.co/t/i-want-message-values-as-feild-using-logstash/303519/10 "2022-04-29T11:59:32Z")
OpenSearch/OpenDistro are AWS run products and differ from the original Elasticsearch and Kibana products that Elastic builds and maintains. You may need to contact them directly for further assistance.
(This is an automated response from your friendly Elastic bot. Please report this post if you have any suggestions or concerns :elasticheart: )
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 27, 2022, 12:00pm UTC](https://discuss.elastic.co/t/i-want-message-values-as-feild-using-logstash/303519/11 "2022-05-27T12:00:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.