# Ingest Pipeline KV processor pattern failures

**URL:** https://discuss.elastic.co/t/ingest-pipeline-kv-processor-pattern-failures/237558
**Category:** Elasticsearch
**Created:** [June 18, 2020, 4:03am UTC](https://discuss.elastic.co/t/ingest-pipeline-kv-processor-pattern-failures/237558 "2020-06-18T04:03:21Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![nmoham](https://avatars.discourse-cdn.com/v4/letter/n/77aa72/32.png) [@nmoham](https://discuss.elastic.co/u/nmoham)
#### Post date: [June 18, 2020, 4:03am UTC](https://discuss.elastic.co/t/ingest-pipeline-kv-processor-pattern-failures/237558/1 "2020-06-18T04:03:21Z")

</div>

Trying to parse syslogs with several KV pairs . The values contain special characters & spaces.

Examples Events-

```auto
sev="INFO" msg="Audit access" cat="\[AUDIT\]" pol="ENC104456DB_SQL_Operational" uinfo="SQLService\\UnPriviligedServices,GRP_Jenkins_Build,SG_DBSvcAccts_Rstrct...\\DCO,dco.elmae" sproc="D:\\Program Files\\Microsoft SQL Server\\MSSQL10_50.ENC104456DB\\MSSQL\\Binn\\sqlservr.exe" act="read_file" gp="f:\\mssql_data" filePath="\\ENC79.mdf:MSSQL_DBCC7" key="None" denyStr="PERMIT" showStr="Code (1A,2M)"
 
sev="INFO" msg="Event" event="Guardpath \\\\bnk11701fs\\bnk11701\\BE6789\\encdata\\Patth is not valid - will not guard (reason: Invalid Guard Path)!"
 
sev="ERROR" msg="failed to contact host" shost="syslogserver" nexttime="Tue Jun 16 05:12:05 PDT 2020"

```

Here's my KV processor -

```auto
  "kv": {
    "field": "syslog_message",
    "field_split": """\s(?![-_,:()\w\"]+?(\s+|\d+|[,_\.]+|$))""",
    "value_split": """(?<!\\\s-:)=""",
    "strip_brackets": true,
    "ignore_failure": true,
    "ignore_missing": true
  }

```

really appreciate any help with this.

---

<div class="post-metadata">

### Author: ![nmoham](https://avatars.discourse-cdn.com/v4/letter/n/77aa72/32.png) [@nmoham](https://discuss.elastic.co/u/nmoham)
#### Post date: [June 18, 2020, 4:36am UTC](https://discuss.elastic.co/t/ingest-pipeline-kv-processor-pattern-failures/237558/2 "2020-06-18T04:36:18Z")

</div>

I managed to get the first & third pattern working with KV processor , but the second one still fails.

---

<div class="post-metadata">

### Author: ![nmoham](https://avatars.discourse-cdn.com/v4/letter/n/77aa72/32.png) [@nmoham](https://discuss.elastic.co/u/nmoham)
#### Post date: [June 18, 2020, 4:59pm UTC](https://discuss.elastic.co/t/ingest-pipeline-kv-processor-pattern-failures/237558/3 "2020-06-18T16:59:26Z")

</div>

got it working finally -

```auto
{
  "kv": {
    "field": "syslog_message",
    "field_split": """\s(?![-_,:()\w\"\\!]+?(\s+|\d+|[,_\.]+|$))""",
    "value_split": """(?<!\\)=""",
    "ignore_failure": true,
    "ignore_missing": true
  }
      }

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 16, 2020, 4:59pm UTC](https://discuss.elastic.co/t/ingest-pipeline-kv-processor-pattern-failures/237558/4 "2020-07-16T16:59:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.