Kv - Drop messages that doesnt match

[PeterH]

Hi,

i want to split up messages with that format with the kv filter plugin:
"key1": "value1", "key2": "value2", "key3": "value3"

This is my kv config:
kv {
trim_value => """
trim_key => ""\ ()"
field_split => ","
value_split => ":"
}

Now I want to define that ervery message which cannot be parsed by the kv plugin will be dropped. I tried that from Github:
if "_kv_filter_error" in [tags] {
drop { }
}

But unfortunately when nothing matched this tag will not assigned.

Has anybode an idea how to achive that?

Thank you!

[Badger]

@PeterH

Has anybode an idea how to achive that?

The _kv_filter_error tag is only applied if an exception is caught by the kv filter. It can fail without raising an exception.

Perhaps you can check for a match against a regexp to decide whether the message has the right format?

[PeterH]

Okay.
How can i implement a standard regex? Or do I have to use a grok filter for that?

[Badger]

Something like this:

    if [message] =~ /^\s*"[^"]+"\s*:\s*"[^"]+",\s*"[^"]+"\s*:\s*"[^"]+",\s*"[^"]+"\s*:\s*"[^"]+"\s*$/ {
        #Do something
    }