# KV filter not working **URL:** \ **Category:** Logstash\ **Created:** [May 24, 2017, 5:19pm UTC](https://discuss.elastic.co/t/kv-filter-not-working/87019 "2017-05-24T17:19:14Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![munotshubham](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/munotshubham/32/22663_2.png) [@munotshubham](https://discuss.elastic.co/u/munotshubham)\ **Post date:** [May 24, 2017, 5:19pm UTC](https://discuss.elastic.co/t/kv-filter-not-working/87019/1 "2017-05-24T17:19:14Z")
config file: ``` filter { if [type] == "syslog" { grok { match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" } add_field => ["received_at", "%{@timestamp}"] add_field => ["received_from", "%{host}"] } syslog_pri { } date { match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] } } if [message] =~ "^#" { drop {} } else { grok { match => {"message" => "%{TIMESTAMP_ISO8601:timestamp} %{IPORHOST:serverip} %{WORD:method} %{URIPATH:stem} %{NOTSPACE:query} %{USERNAME:username} %{GREEDYDATA:referer} %{NUMBER:stat} %{NUMBER:scBytes} %{NUMBER:csBytes} %{NUMBER:totalTime}" } } mutate { convert => { "totalTime" => "float" } convert => { "scBytes" => "float" } convert => { "csBytes" => "float" } convert => { "stat" => "float" } } kv { source => "stem" field_split => "/" prefix => "stem_" } } } ``` I want my uri\_stem to be in different fields eg: /Services/UserPageSearchHelper.svc/GetPracticeConfigurationValue field 1: Services field 2: UserPageSearchHelper.svc field 3: GetPracticeConfigurationValue LOG FILE: 2017-05-24T12:49:37,074][INFO][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=\>{:removed=\>[], :added=\>[[http://localhost:9200/](http://localhost:9200/)]}} [2017-05-24T12:49:37,081][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://localhost:9200/](http://localhost:9200/), :path=\>"/"} [2017-05-24T12:49:37,241][WARN][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=\>#\} [2017-05-24T12:49:37,248][INFO][logstash.outputs.elasticsearch] New Elasticsearch output {:class=\>"LogStash::Outputs::ElasticSearch", :hosts=\>[#\]} [2017-05-24T12:49:37,398][INFO][logstash.pipeline] Starting pipeline {"id"=\>"main", "pipeline.workers"=\>4, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>5, "pipeline.max\_inflight"=\>500} [2017-05-24T12:49:38,274][INFO][logstash.inputs.beats] Beats inputs: Starting input listener {:address=\>"0.0.0.0:5044"} [2017-05-24T12:49:38,337][INFO][logstash.pipeline] Pipeline main started [2017-05-24T12:49:38,485][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600} [2017-05-24T12:49:42,323][INFO][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=\>{:removed=\>[[http://localhost:9200/](http://localhost:9200/)], :added=\>[[http://127.0.0.1:9200/](http://127.0.0.1:9200/)]}} [2017-05-24T12:49:42,327][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://127.0.0.1:9200/](http://127.0.0.1:9200/), :path=\>"/"} [2017-05-24T12:49:42,340][WARN][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=\>#\} ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 25, 2017, 9:32am UTC](https://discuss.elastic.co/t/kv-filter-not-working/87019/2 "2017-05-25T09:32:01Z")
And what's not working? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [May 25, 2017, 12:46pm UTC](https://discuss.elastic.co/t/kv-filter-not-working/87019/3 "2017-05-25T12:46:26Z")
The kv filter is designed to parse a list of key-value pairs, e.g. `key1=value1,key2=value2` which does not seem too be what you have in the field. You could use grok to separate out the different parts or maybe even treat it as a csv string with a '/' separator. ---
**Author:** ![munotshubham](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/munotshubham/32/22663_2.png) [@munotshubham](https://discuss.elastic.co/u/munotshubham)\ **Post date:** [May 25, 2017, 2:09pm UTC](https://discuss.elastic.co/t/kv-filter-not-working/87019/4 "2017-05-25T14:09:54Z")
Yeah I figured that out later. Thanks. ---
**Author:** ![munotshubham](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/munotshubham/32/22663_2.png) [@munotshubham](https://discuss.elastic.co/u/munotshubham)\ **Post date:** [May 31, 2017, 3:51pm UTC](https://discuss.elastic.co/t/kv-filter-not-working/87019/5 "2017-05-31T15:51:52Z")
If anyone still looking for answer ``` grok { match => ["stem","/(?[^/]+)/(?[^/]+)/(?[^/]+)/(?[^/]+)", "stem","/(?[^/]+)/(?[^/]+)/(?[^/]+)", "stem","/(?[^/]+)/(?[^/]+)"] } ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 28, 2017, 3:51pm UTC](https://discuss.elastic.co/t/kv-filter-not-working/87019/6 "2017-06-28T15:51:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.