# Kv filter: empty value after key yields strange behavior **URL:** \ **Category:** Logstash\ **Created:** [August 3, 2018, 7:31pm UTC](https://discuss.elastic.co/t/kv-filter-empty-value-after-key-yields-strange-behavior/142965 "2018-08-03T19:31:55Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Micah\_Hunsberger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/micah_hunsberger/32/147436_2.png) [@Micah\_Hunsberger](https://discuss.elastic.co/u/Micah_Hunsberger)\ **Post date:** [August 3, 2018, 7:31pm UTC](https://discuss.elastic.co/t/kv-filter-empty-value-after-key-yields-strange-behavior/142965/1 "2018-08-03T19:31:55Z")
Logstash version 6.3.0 I'm using the kv filter with the default settings, which means: ```auto value_split => "=" field_split => " " ``` If I send a message with the format of `key=` without a value on the other side, it interprets the following key-value as the value for that key. Meaning, `key= key2=value` is interpreted the same as `key="key2=value"`. You can replicate this behavior by running Logstash with ```auto bin/logstash -e "input{ stdin{} } filter{ kv{} } output{ stdout{} }" ``` and then try the following inputs through stdin: ### All keys w/ values (pass) **input** : `key1=value1 key2=value2 key3=value3` **output** : ```auto { "@version" => "1", "key1" => "value1", "message" => "key1=value1 key2=value2 key3=value3\r" "host" => "logstash", "@timestamp" => 2018-08-03T19:16:11.129Z, "key2" => "value2", "key3" => "value3\r" } ``` ### second key missing value (fail) **input** : `key1=value1 key2= key3=value3` **output** : ```auto { "@version" => "1", "key1" => "value1", "message" => "key1=value1 key2= key3=value3\r", "host" => "logstash", "@timestamp" => 2018-08-03T19:16:20.520Z, "key2" => "key3=value3\r" } ``` ### first key missing value (fail) **input** : `key1= key2=value2 key3=value3` **output** : ```auto { "@version" => "1", "key1" => "key2=value2", "message" => "key1= key2=value2 key3=value3\r", "host" => "logstash", "@timestamp" => 2018-08-03T19:16:34.751Z, "key3" => "value3\r" } ``` ### first key with empty quote (pass) **input** : `key1="" key2=value2 key3=value3` **output** : ```auto { "@version" => "1", "message" => "key1=\"\" key2=value2 key3=value3\r", "host" => "logstash", "@timestamp" => 2018-08-03T19:16:49.252Z, "key2" => "value2", "key3" => "value3\r" } ``` ### last key with missing value (pass) **input** : `key1=value1 key2=value2 key3=` **output** : ```auto { "@version" => "1", "key1" => "value1", "message" => "key1=value1 key2=value2 key3=\r", "host" => "logstash", "@timestamp" => 2018-08-03T19:17:34.828Z, "key2" => "value2" } ``` Is there a way to tell the kv filter that an empty space after the `=` means the key has a null value? Thanks ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 3, 2018, 7:59pm UTC](https://discuss.elastic.co/t/kv-filter-empty-value-after-key-yields-strange-behavior/142965/2 "2018-08-03T19:59:38Z")
You cannot have empty values. But you could do something like ``` mutate { gsub => ["message", "= ", "='' "] } ``` ---
**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\ **Post date:** [August 3, 2018, 8:32pm UTC](https://discuss.elastic.co/t/kv-filter-empty-value-after-key-yields-strange-behavior/142965/3 "2018-08-03T20:32:10Z")
The KV filter plugin now has a `whitespace => "strict"` mode, which was recently added to address this issue. The original parser was too lenient with whitespace, and was unable to differentiate an empty unquoted value from an optional whitespace that occurred before a value. You may need to update the plugin. ---
**Author:** ![Micah\_Hunsberger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/micah_hunsberger/32/147436_2.png) [@Micah\_Hunsberger](https://discuss.elastic.co/u/Micah_Hunsberger)\ **Post date:** [August 3, 2018, 8:32pm UTC](https://discuss.elastic.co/t/kv-filter-empty-value-after-key-yields-strange-behavior/142965/4 "2018-08-03T20:32:59Z")
Thank you, that worked! I didn't think about replacing with quotes. I have another problem, (I'm trying to capture logs from a firewall), which is that sometimes the messages I am receiving do not encapsulate the values in quotes if they contain spaces, which is also the field split, but the keys are always whole words. an example would be a message that looks like this: `key1=value key2=complex multiword value key3=anothervalue` Does gsub allow you to replace capture groups? If so, I could make a regular expression that captures spaced-values and replaces the value with quotes surrounding it. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 3, 2018, 8:48pm UTC](https://discuss.elastic.co/t/kv-filter-empty-value-after-key-yields-strange-behavior/142965/5 "2018-08-03T20:48:15Z")
Yes, it support capture groups. ``` mutate { gsub => ["message", "(foo)bar(baz)", "\1 or \2"] } ``` would get you "foo or baz" ---
**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\ **Post date:** [August 7, 2018, 11:56pm UTC](https://discuss.elastic.co/t/kv-filter-empty-value-after-key-yields-strange-behavior/142965/6 "2018-08-07T23:56:30Z")
OR, if your keys are predictable enough, you could use the KV Filter Plugin's [`field_split_pattern` directive](https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html#plugins-filters-kv-field_split_pattern) and a regular expression _lookahead_ to only split fields by spaces that come before keys: I've crafted a pattern for you with tests here -\> [http://rubular.com/r/08Ol37nQeG](http://rubular.com/r/08Ol37nQeG) For example, if my keys _always_ were alphanumeric and matched `[A-Za-z0-9]+`, I would define the pattern with a lookahead like so: ```auto field_split_pattern => " (?=[A-Za-z0-9]+=)" ``` I'll break that expression up and explain what is going on: Split on any - space - `(?=`: that is followed by: - `[A-Za-z0-9]+`: a sequence of 1 or more alphanumeric characters then - `=` an equals sign - `)` _end lookahead_ ---
**Author:** ![Micah\_Hunsberger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/micah_hunsberger/32/147436_2.png) [@Micah\_Hunsberger](https://discuss.elastic.co/u/Micah_Hunsberger)\ **Post date:** [August 8, 2018, 1:40pm UTC](https://discuss.elastic.co/t/kv-filter-empty-value-after-key-yields-strange-behavior/142965/7 "2018-08-08T13:40:47Z")
Thanks! This seems like a better solution than the road I was going down. I was attempting to capture the whole message with `gsub` and do a replace with this regular expression to put quotes around the values -\> [http://rubular.com/r/HsNA8E2kDR](http://rubular.com/r/HsNA8E2kDR) ```auto regex > (\w+)=([^=]*)(?=\s) subsitution > \1="\2" ``` But I would have had to force a space at the end of the message. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 5, 2018, 1:40pm UTC](https://discuss.elastic.co/t/kv-filter-empty-value-after-key-yields-strange-behavior/142965/8 "2018-09-05T13:40:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.