# Kv field\_split with bracketed internal data

**URL:** <https://discuss.elastic.co/t/kv-field-split-with-bracketed-internal-data/59603>\
**Category:** Logstash\
**Created:** [September 1, 2016, 9:26pm UTC](https://discuss.elastic.co/t/kv-field-split-with-bracketed-internal-data/59603 "2016-09-01T21:26:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Michael\_Tracey](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michael_tracey/32/11338_2.png) [@Michael\_Tracey](https://discuss.elastic.co/u/Michael_Tracey)\
**Post date:** [September 1, 2016, 9:26pm UTC](https://discuss.elastic.co/t/kv-field-split-with-bracketed-internal-data/59603/1 "2016-09-01T21:26:45Z")

</div>

I've got some incoming data that looks like this:

`author:(neil stephenson) title:(snow crash)`

I would like to KV on spaces, but only on spaces not wrapped in parenthesis. These settings doesn't seem to cut it:

```
value_split => ":"
field_split => " "
include_brackets => true

```

Secondly, some times this field also includes extra unsplitable data:

`author:(neil stephenson) title:(snow crash) some extra raw keywords here`

Is there any way to get any matched keys that have no value data from the kv, and join them (in order) back together? Any ideas on how to split this would be appreciated.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:40am UTC](https://discuss.elastic.co/t/kv-field-split-with-bracketed-internal-data/59603/2 "2017-07-06T04:40:21Z")

</div>

Closed on July 6, 2017, 4:40am UTC