# KV filter to display null keys

**URL:** <https://discuss.elastic.co/t/kv-filter-to-display-null-keys/147766>\
**Category:** Logstash\
**Created:** [September 7, 2018, 8:15pm UTC](https://discuss.elastic.co/t/kv-filter-to-display-null-keys/147766 "2018-09-07T20:15:01Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![nilsb](https://avatars.discourse-cdn.com/v4/letter/n/b2d939/32.png) [@nilsb](https://discuss.elastic.co/u/nilsb)\
**Post date:** [September 7, 2018, 8:15pm UTC](https://discuss.elastic.co/t/kv-filter-to-display-null-keys/147766/1 "2018-09-07T20:15:01Z")

</div>

Hi experts,  
I am completely new to Logstash and started using logstash 6.4.0 a day before 🙂

Problem statement:  
I am trying to parse an application log using kv filter. The separator within the log line is tilde "~". I am able to get the key-value pairs for the not-null fields, but the null fields are getting ignored by the filter.

Example:  
Sample Logline:  
2018-09-06 16:51:16.337 INFO (THREAD-438) system\_monitor : - LogTypeID=SAMPLELOG~RespCd=SAMPLE RESPONSE~MsgID=123456~HostNm=~SysTs=2018-09-06T16:51:16.312-07:00~AppID=SAMPLE~OrigCtyCd=~UPID=~PaySplitSeqNo=~AllocSeqNo=~AppServNmVr=Notify~PayTpChCd=~Amt=0~Curr=~SplitAmt=0~SplitCurr=~EventID="

Observation:  
The split is happening as follows:  
2018-09-06 16:51:16.337 INFO (THREAD-438) system\_monitor : - LogTypeID=SAMPLELOG  
RespCd=SAMPLE RESPONSE  
MsgID=123456  
....

But the following keys are gettting ignored (as they don't have a value associated) and not showing up:  
OrigCtyCd  
UPID  
EventID  
...

Please advise if there is way to display the NULL fields too?  
regards..

---

<div class="post-metadata">

**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\
**Post date:** [September 7, 2018, 10:23pm UTC](https://discuss.elastic.co/t/kv-filter-to-display-null-keys/147766/2 "2018-09-07T22:23:56Z")

</div>

That's not _currently_ an option, but I just opened up a pull-request on the project to make it be one, so there's a good chance we'll be able to address your need soon.

The one caveat is: when this is enabled, the empty fields captured in this way will be zero-length strings, not `null`.

> <https://github.com/logstash-plugins/logstash-filter-kv/pull/72>

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 5, 2018, 10:23pm UTC](https://discuss.elastic.co/t/kv-filter-to-display-null-keys/147766/3 "2018-10-05T22:23:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.