# Key value pair

**URL:** https://discuss.elastic.co/t/key-value-pair/163260
**Category:** Logstash
**Created:** [January 7, 2019, 7:13pm UTC](https://discuss.elastic.co/t/key-value-pair/163260 "2019-01-07T19:13:59Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![tgdesrochers](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tgdesrochers/32/51322_2.png) [@tgdesrochers](https://discuss.elastic.co/u/tgdesrochers)
#### Post date: [January 7, 2019, 7:13pm UTC](https://discuss.elastic.co/t/key-value-pair/163260/1 "2019-01-07T19:13:59Z")

</div>

Good afternoon. I am trying to use KVP to separate the key value pair in my "Message" field.

```auto
"{"EventTime":"2019-01-07 18:20:42.826361Z","Hostname":"186590cbd0f7","Message":"EPS: 99","EventReceivedTime":"2019-01-07 18:20:42.826373Z","isServer":"False","esmVersion":"1.6.9","esmType":"metric"}"

```

I have tried

```auto
filter {
  kv {
    source => 'Message'
    target => 'EPS'
    value_split => ": "
    field_split => ": "
  }
}

```

This results in:

```auto
{"host":"186590cbd0f7","@timestamp":"2019-01-07T19:06:14.014Z","message":"{EventTime:2019-01-07 18:20:42.826361Z,Hostname:186590cbd0f7,Message:EPS: 99,EventReceivedTime:2019-01-07 18:20:42.826373Z,isServer:False,esmVersion:1.6.9,esmType:metric}","@version":"1","path":"/tmp/testfile"}

```

Which shows the KV working somewhat but on the `message` field not the `Message` field

What I am trying to do is pull out `Message: EPS: <some_value>` to EPS:\<some\_value\>`

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 7, 2019, 8:31pm UTC](https://discuss.elastic.co/t/key-value-pair/163260/2 "2019-01-07T20:31:09Z")

</div>

If that really is the input line then I would strip off the outmost quotes and parse it as JSON to get a Message field.

```
filter { mutate { gsub => ["message", '(^"|"$)', ''] } }
filter { json { source => "message" } }
filter { kv { source => "Message" value_split => ":" } }

```

which will get you

```
          "esmType" => "metric",
        "EventTime" => "2019-01-07 18:20:42.826361Z",
          "Message" => "EPS: 99",
          "message" => "{\"EventTime\":\"2019-01-07 18:20:42.826361Z\",\"Hostname\":\"186590cbd0f7\",\"Message\":\"EPS: 99\",\"EventReceivedTime\":\"2019-01-07 18:20:42.826373Z\",\"isServer\":\"False\",\"esmVersion\":\"1.6.9\",\"esmType\":\"metric\"}",
         "isServer" => "False",
              "EPS" => "99",
       "esmVersion" => "1.6.9",
         "Hostname" => "186590cbd0f7",
"EventReceivedTime" => "2019-01-07 18:20:42.826373Z"
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 4, 2019, 8:35pm UTC](https://discuss.elastic.co/t/key-value-pair/163260/3 "2019-02-04T20:35:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.