KV filter problem with value_split

[DanV (Daniel Venzi)]

Hello,

i'm using the kv filter to parse a log, especially field named User that has a string value of:

                User Name: Daniel Venzi

the kv filter is in the format:

             kv {
                         source => "User"
                         value_split => ":"
                  }

as a result i create a key named "Name" with an associated value of "Daniel". But that's not what i need. I want to use the kv filter in way that everything before the value_split is a key and the string after the value_split is the key associated value. Something like:

            "User Name" => "Daniel Venzi"

is there a way to do this?

Thanks in advance!

[Badger]

You need to set field split to something other than the default, which is space. If, for example, you set field_split => "/" you would get what you want.