Kv - Drop messages that doesnt match


i want to split up messages with that format with the kv filter plugin:
"key1": "value1", "key2": "value2", "key3": "value3"

This is my kv config:
kv {
trim_value => """
trim_key => ""\ ()"
field_split => ","
value_split => ":"

Now I want to define that ervery message which cannot be parsed by the kv plugin will be dropped. I tried that from Github:
if "_kv_filter_error" in [tags] {
drop { }

But unfortunately when nothing matched this tag will not assigned.

Has anybode an idea how to achive that?

Thank you!

The _kv_filter_error tag is only applied if an exception is caught by the kv filter. It can fail without raising an exception.

Perhaps you can check for a match against a regexp to decide whether the message has the right format?

How can i implement a standard regex? Or do I have to use a grok filter for that?

Something like this:

    if [message] =~ /^\s*"[^"]+"\s*:\s*"[^"]+",\s*"[^"]+"\s*:\s*"[^"]+",\s*"[^"]+"\s*:\s*"[^"]+"\s*$/ {
        #Do something
1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.