Ingest KV processor and pattern

Elastic Stack Elasticsearch
1

Hello,

I'm trying to use the kv processor with patterns. As mentioned in the documentation, the "field_split" can use a regex pattern to use for splitting key-value pairs, but I can't find examples.

I have a working PCRE regex here, tested from https://regex101.com/:
(?!=)([a-zA-Z0-9.:\/ ]*=[a-zA-Z0-9.:\/ _-]*)( |$)

But now how can I use it from the kv processor?

Thanks for your help!

2

Ok, found it, my regex was wrong, as it need to match the field_split only (not a group):
field_split" : "(?!\\w+=\\S+)\\s(?!\\w+\\s)

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.