# KV filter in logstash 7.2.0 doesn't store a key having empty value

**URL:** <https://discuss.elastic.co/t/kv-filter-in-logstash-7-2-0-doesnt-store-a-key-having-empty-value/193461>\
**Category:** Logstash\
**Created:** [August 2, 2019, 6:48am UTC](https://discuss.elastic.co/t/kv-filter-in-logstash-7-2-0-doesnt-store-a-key-having-empty-value/193461 "2019-08-02T06:48:48Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ritesh\_singh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ritesh_singh/32/51491_2.png) [@ritesh\_singh](https://discuss.elastic.co/u/ritesh_singh)\
**Post date:** [August 2, 2019, 6:48am UTC](https://discuss.elastic.co/t/kv-filter-in-logstash-7-2-0-doesnt-store-a-key-having-empty-value/193461/1 "2019-08-02T06:48:48Z")

</div>

Hi  
I am trying to parse a log in the following format

2018-12-18 19:50:37 SNID:1|CTI:1105154514|SL:20|SMS:706C73|SMSC:1|PSI\_RF:00|SRCIP:172.25.25.119|DESTIP:|SN:|DN:

i am using KV filter plugin to get it done, but i am getting issue that the keys having no values are getting skipped and not getting parsed. Please help

i am using the following code :

grok{  
match=\>{  
"message"=\>"%{TIMESTAMP\_ISO8601:dateTime}\s+{GREEDYDATA:CDR\_Body}"  
}  
}  
grok{  
match=\>{"dateTime" =\> "%{DATE:date} %{TIME:time}"}  
}  
kv{  
source =\> "CDR\_Body"  
value\_split =\> ":"  
field\_split =\> "|"  
remove\_field =\> ["dateTime"]  
remove\_field =\> ["message"]  
}

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 2, 2019, 12:56pm UTC](https://discuss.elastic.co/t/kv-filter-in-logstash-7-2-0-doesnt-store-a-key-having-empty-value/193461/2 "2019-08-02T12:56:38Z")

</div>

> [@ritesh\_singh](#):
>
> i am getting issue that the keys having no values are getting skipped and not getting parsed

This is working as designed. (Looking at the [test cases](https://github.com/logstash-plugins/logstash-filter-kv/pull/67/files) for the PR that introduced the 'whitespace' option they verify that empty fields are not captured.)

If you know what the fields are called you might be able to use the [default\_keys](https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html#plugins-filters-kv-default_keys) option to supply values for those fields.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 30, 2019, 12:56pm UTC](https://discuss.elastic.co/t/kv-filter-in-logstash-7-2-0-doesnt-store-a-key-having-empty-value/193461/3 "2019-08-30T12:56:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.