# KV filter not splitting log

**URL:** <https://discuss.elastic.co/t/kv-filter-not-splitting-log/247380>\
**Category:** Logstash\
**Created:** [September 3, 2020, 12:36pm UTC](https://discuss.elastic.co/t/kv-filter-not-splitting-log/247380 "2020-09-03T12:36:47Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![varun1992](https://avatars.discourse-cdn.com/v4/letter/v/3da27b/32.png) [@varun1992](https://discuss.elastic.co/u/varun1992)\
**Post date:** [September 3, 2020, 12:36pm UTC](https://discuss.elastic.co/t/kv-filter-not-splitting-log/247380/1 "2020-09-03T12:36:47Z")

</div>

My config file as below. It's not splitting log read by grok

```
input {
  file {
    path => "/log/ForwardTrafficLog.log"
    start_position => "beginning"
  }
}

filter {

 grok { 	
	 	match => {
 		   "message" => ["%{GREEDYDATA:syslog}$"]
	  	}
   }
   
   kv {
       source => "syslog"
       field_split => " (?=[a-z\\_\\-]+=)"
       value_split => "="
       prefix => "log."
       trim_value => "\""
   }
}

output {
  stdout { codec => rubydebug }
}

```

My log as below

`date=2020-04-23 time=12:14:28 devname="firewall3" devid="oldfwid" logid="0000000013" vwlquality="Seq_num(3), alive, selected" wanin=1130`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 1, 2020, 12:36pm UTC](https://discuss.elastic.co/t/kv-filter-not-splitting-log/247380/2 "2020-10-01T12:36:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.