# KV Filter Question

**URL:** <https://discuss.elastic.co/t/kv-filter-question/82702>\
**Category:** Logstash\
**Created:** [April 18, 2017, 11:17am UTC](https://discuss.elastic.co/t/kv-filter-question/82702 "2017-04-18T11:17:28Z")\
**Posts on this page:** 1\
**Showing post:** 13

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 25, 2017, 1:26pm UTC](https://discuss.elastic.co/t/kv-filter-question/82702/13 "2017-04-25T13:26:40Z")

</div>

You can use either, but kv is simpler. If you really want "WinFileService Event" to be a key you don't need a grok filter at all.

---

_[View the full topic](https://discuss.elastic.co/t/kv-filter-question/82702)._