# Kv filter: a number added in the beginning of the field

**URL:** https://discuss.elastic.co/t/kv-filter-a-number-added-in-the-beginning-of-the-field/42266
**Category:** Logstash
**Created:** [February 19, 2016, 5:18pm UTC](https://discuss.elastic.co/t/kv-filter-a-number-added-in-the-beginning-of-the-field/42266 "2016-02-19T17:18:33Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![taraka16](https://avatars.discourse-cdn.com/v4/letter/t/97f17d/32.png) [@taraka16](https://discuss.elastic.co/u/taraka16)
#### Post date: [February 19, 2016, 5:18pm UTC](https://discuss.elastic.co/t/kv-filter-a-number-added-in-the-beginning-of-the-field/42266/1 "2016-02-19T17:18:33Z")

</div>

This is my conf file:

```
input {
  file {
    start_position => "beginning"
    path => ["/home/taraka/Projects/neonion/logs/*.log"]
    type => "syslog"
  }
}

filter{

  multiline {
	    pattern => "\[\#\|\d{4}"
	    negate => true
     what => "previous"
    }
   grok {
    match => ["message", "(?<highlight_created>(highlight_created))"]
    break_on_match => false
    }
   grok {
    match => ["message", "(?<highlight_deleted>(highlight_deleted))"]
    break_on_match => false
    } 

   kv {
    source => "message"
    field_split => ","
    value_split => "="
     }
}
output {
  if[type]=="syslog"{
    elasticsearch {host => "localhost"}
    stdout { codec => rubydebug}
  }
}

```

and the output looks like this:

 ![](https://us1.discourse-cdn.com/elastic/original/2X/8/8052b8a4bb2a656d3dfa076eb18bd1993aa199ff.png)

I need to have the field comment\_created without the number beside. How can I do it?

---

<div class="post-metadata">

### Author: ![msimos](https://avatars.discourse-cdn.com/v4/letter/m/bb73d2/32.png) [@msimos](https://discuss.elastic.co/u/msimos)
#### Post date: [February 19, 2016, 5:45pm UTC](https://discuss.elastic.co/t/kv-filter-a-number-added-in-the-beginning-of-the-field/42266/2 "2016-02-19T17:45:32Z")

</div>

Hi,

You should first use something like:

```auto
       grok {
          match => ["message", "%{TIMESTAMP_ISO8601:timestamp} %{GREEDYDATA:logmessage}"]
       }

```

Then use the following to split on the comma:

```auto
kv {
   source => logmessage
   etc...

```

---

<div class="post-metadata">

### Author: ![taraka16](https://avatars.discourse-cdn.com/v4/letter/t/97f17d/32.png) [@taraka16](https://discuss.elastic.co/u/taraka16)
#### Post date: [February 23, 2016, 1:04pm UTC](https://discuss.elastic.co/t/kv-filter-a-number-added-in-the-beginning-of-the-field/42266/3 "2016-02-23T13:04:17Z")

</div>

@msimos Thank you very much! it works!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:10am UTC](https://discuss.elastic.co/t/kv-filter-a-number-added-in-the-beginning-of-the-field/42266/4 "2017-07-06T05:10:09Z")

</div>