# Ingest KV processor and pattern

**URL:** https://discuss.elastic.co/t/ingest-kv-processor-and-pattern/211157
**Category:** Elasticsearch
**Created:** [December 9, 2019, 4:46pm UTC](https://discuss.elastic.co/t/ingest-kv-processor-and-pattern/211157 "2019-12-09T16:46:22Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![rverchere](https://avatars.discourse-cdn.com/v4/letter/r/dbc845/32.png) [@rverchere](https://discuss.elastic.co/u/rverchere)
#### Post date: [December 9, 2019, 4:46pm UTC](https://discuss.elastic.co/t/ingest-kv-processor-and-pattern/211157/1 "2019-12-09T16:46:22Z")

</div>

Hello,

I'm trying to use the kv processor with patterns. As mentioned in the documentation, the "field\_split" can use a regex pattern to use for splitting key-value pairs, but I can't find examples.

I have a working PCRE regex here, tested from [https://regex101.com/:](https://regex101.com/:)  
`(?!=)([a-zA-Z0-9.:\/]*=[a-zA-Z0-9.:\/ _-]*)( |$)`

But now how can I use it from the kv processor?

Thanks for your help!

---

<div class="post-metadata">

### Author: ![rverchere](https://avatars.discourse-cdn.com/v4/letter/r/dbc845/32.png) [@rverchere](https://discuss.elastic.co/u/rverchere)
#### Post date: [December 9, 2019, 8:44pm UTC](https://discuss.elastic.co/t/ingest-kv-processor-and-pattern/211157/2 "2019-12-09T20:44:08Z")

</div>

Ok, found it, my regex was wrong, as it need to match the field\_split only (not a group):  
`field_split" : "(?!\\w+=\\S+)\\s(?!\\w+\\s)`

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 6, 2020, 8:44pm UTC](https://discuss.elastic.co/t/ingest-kv-processor-and-pattern/211157/3 "2020-01-06T20:44:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
