# Kv Filter is not working

**URL:** <https://discuss.elastic.co/t/kv-filter-is-not-working/121523>\
**Category:** Logstash\
**Created:** [February 26, 2018, 4:19pm UTC](https://discuss.elastic.co/t/kv-filter-is-not-working/121523 "2018-02-26T16:19:00Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Adansar](https://avatars.discourse-cdn.com/v4/letter/a/b4bc9f/32.png) [@Adansar](https://discuss.elastic.co/u/Adansar)\
**Post date:** [February 26, 2018, 4:19pm UTC](https://discuss.elastic.co/t/kv-filter-is-not-working/121523/1 "2018-02-26T16:19:00Z")

</div>

Hello,

I had a problem while parsing some logs, example :

2018-01-26 13:05:36.072Z ERROR [Camel (context-autoprov) thread #2 - JmsConsumer[inject]] n.a.cle.business.PairingAutoProcess - [PL-MROV-002][RO:REM\_JUnit\_2][XIN:Xin#!&] XIN is not alphanum in [XIN:xin#!&]

2018-02-13 13:16:21.301Z ERROR [Camel (context-autoprov) thread #1 - JmsConsumer[inject]] n.a.cle.business.PairingAutoProcess - [PL-MROV-007][RO:Remote\_N\_5050000000000009][XIN:XINTEST][OrderId:158528542] Could not notify the other side for pairing response

2018-02-13 13:16:21.291Z ERROR ContextID=NO\_CONTEXT [http-bio-8098-exec-3] n.a.c.s.e.m.w.i.MROVServiceImpl - [PL\_MROV-085][ROS:[Remote\_N\_5050000000000009]] Call Send Generic Command (XLT webservice), failed - error : org.apache.cxf.service.factory.ServiceConstructionException: Failed to create service.

I tried that pattern :

%{TIMESTAMP\_ISO8601:log\_date} %{LOGLEVEL:log\_level} %{GREEDYDATA:context} - [%{DATA:error\_code}][%{GREEDYDATA:XY}] %{GREEDYDATA:msg}

Then i use the logstash module kv this way :

if [XY]{  
#parse "XY" field with key value  
kv {  
source =\> "XY"  
field\_split =\> "]["  
value\_split =\> ":"  
include\_brackets =\> false  
}  
}

I had a problem in field\_split and i corrected it, I forgot to put "" before brackets.

But even after that correction, I don't even these logs on kibana, while i'm getting all the other logs.

Thank you in advance.

Regards.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 26, 2018, 4:19pm UTC](https://discuss.elastic.co/t/kv-filter-is-not-working/121523/2 "2018-03-26T16:19:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.