KV filter problem with value_split

(Daniel Venzi) #1


i'm using the kv filter to parse a log, especially field named User that has a string value of:

                User Name: Daniel Venzi

the kv filter is in the format:

             kv {
                         source => "User"
                         value_split => ":"

as a result i create a key named "Name" with an associated value of "Daniel". But that's not what i need. I want to use the kv filter in way that everything before the value_split is a key and the string after the value_split is the key associated value. Something like:

            "User Name" => "Daniel Venzi"

is there a way to do this?

Thanks in advance!


You need to set field split to something other than the default, which is space. If, for example, you set field_split => "/" you would get what you want.

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.