# KV filter: Detect malformed messages

**URL:** <https://discuss.elastic.co/t/kv-filter-detect-malformed-messages/166266>\
**Category:** Logstash\
**Created:** [January 30, 2019, 6:24am UTC](https://discuss.elastic.co/t/kv-filter-detect-malformed-messages/166266 "2019-01-30T06:24:18Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![imehl](https://avatars.discourse-cdn.com/v4/letter/i/8797f3/32.png) [@imehl](https://discuss.elastic.co/u/imehl)\
**Post date:** [January 30, 2019, 6:24am UTC](https://discuss.elastic.co/t/kv-filter-detect-malformed-messages/166266/1 "2019-01-30T06:24:18Z")

</div>

Hi,

I have incoming messages with the format:  
`key1=5 key2='value 2' key3=value`  
(many values, dynamic)

...and I'm using the KV filter to extract the key value pairs, which works as expected.

Now I also have incoming messages which are standard text messages and I want to detect these in Logstash. Do you have any hint how I can achieve this (ruby, regex)?

---

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [January 30, 2019, 2:48pm UTC](https://discuss.elastic.co/t/kv-filter-detect-malformed-messages/166266/2 "2019-01-30T14:48:47Z")

</div>

Use a regex conditional block to apply a the KV section and the regular text gets processed in the `else` block.  
[https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals)  
Example:

```auto
if [message] =~ /(\w+=(("\w+\s+(\w+)?")|('\w+\s+(\w+)?')|\w+)\s){2,}/ {
  # must have at least 2 KV like sections
} else {
  # might have one section that looks like KV but is not
}

```

> **[Online regex tester and debugger: PHP, PCRE, Python, Golang and JavaScript](https://regex101.com/r/Gpn6g1/1)**
>
> Regex101 allows you to create, debug, test and have your expressions explained for PHP, PCRE, Python, Golang and JavaScript. The website also features a community where you can share useful expressions.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 27, 2019, 2:52pm UTC](https://discuss.elastic.co/t/kv-filter-detect-malformed-messages/166266/3 "2019-02-27T14:52:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.