# KV Filter to include spaces in selected fields/values **URL:** \ **Category:** Logstash\ **Created:** [May 22, 2017, 7:47pm UTC](https://discuss.elastic.co/t/kv-filter-to-include-spaces-in-selected-fields-values/86733 "2017-05-22T19:47:49Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Sameer\_Panicker](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Post date:** [May 22, 2017, 7:47pm UTC](https://discuss.elastic.co/t/kv-filter-to-include-spaces-in-selected-fields-values/86733/1 "2017-05-22T19:47:49Z")
My log line has a field with "[reasonPhrase : Internal Server Error]" as value. I need to extract the reasonPhrase field and value as Internal Server Error. But with the current filter or the default kv filter, only Internal is extracted. This is my filter - ![](https://us1.discourse-cdn.com/elastic/original/3X/2/1/21342474f3e111b0841145f11d5920544e2a3a69.png) Also, is it possible to include spaces in selected fields only ? i.e. I want space to be included in reasonPhrase only and not in content. ---
**Author:** ![Nico-DF](https://avatars.discourse-cdn.com/v4/letter/n/ed8c4c/32.png) [@Nico-DF](https://discuss.elastic.co/u/Nico-DF)\ **Post date:** [May 23, 2017, 11:37am UTC](https://discuss.elastic.co/t/kv-filter-to-include-spaces-in-selected-fields-values/86733/2 "2017-05-23T11:37:33Z")
If I don't make any mistake, it due to the fact that, by default, field\_split in kv filter is set to space. So it only considers the 1st word as value. Try maybe not to remove ] and set it as separator or something else (depending on how your whole log line looks like) ---
**Author:** ![Sameer\_Panicker](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Post date:** [May 23, 2017, 2:31pm UTC](https://discuss.elastic.co/t/kv-filter-to-include-spaces-in-selected-fields-values/86733/3 "2017-05-23T14:31:32Z")
Thanks for the reply Nico. This is what my log looks like. EventId : 1, Level : Informational, Message : , Payload : [id : b6c286ed-7f12-497a-b7ef-18a19404675a] [ipAddress : 111.11.111.123] [method : GET] [requestUri : [http://server2:8080/MyService/api/healthcheck](http://server2:8080/MyService/api/healthcheck)] [content :] , EventName : RequestInfo, Timestamp : 2017-01-16T06:00:43.1780011Z, ProcessId : 2288, ThreadId : 5588 EventId : 3, Level : Informational, Message : , Payload : [id : b6c286ed-7f12-497a-b7ef-18a19404675a] [headers : Connection: Keep-Alive Accept-Encoding: gzip, deflate Host: server2:8080 User-Agent: Manticore 0.5.5 CallerANI: 123-123-1234 CallID: 431-431-4311 ClientID: MyClientID OperationID: OperationID ProcessStepID: ProcessStepID ServerIPAddress: 123.123.123.123 TFN: 1-800-ABCD] , EventName : RequestInfo, Timestamp : 2017-01-16T06:00:43.1780803Z, ProcessId : 2288, ThreadId : 5588 EventId : 2, Level : Informational, Message : , Payload : [id : b6c286ed-7f12-497a-b7ef-18a19404675a] [reasonPhrase : OK] [content : {"configuration":"Dev","now":"2017-01-16T06:00:42.7792925Z"}] , EventName : ResponseInfo, Timestamp : 2017-01-16T06:00:43.1785513Z, ProcessId : 2288, ThreadId : 5588 And I need to extract values - Method, ReasonPhrase....ID Let me know how should I update my filter. ---
**Author:** ![Nico-DF](https://avatars.discourse-cdn.com/v4/letter/n/ed8c4c/32.png) [@Nico-DF](https://discuss.elastic.co/u/Nico-DF)\ **Post date:** [May 24, 2017, 7:03am UTC](https://discuss.elastic.co/t/kv-filter-to-include-spaces-in-selected-fields-values/86733/4 "2017-05-24T07:03:26Z")
You want to use kv for your whole line or only for Payload event? ---
**Author:** ![Sameer\_Panicker](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Post date:** [May 24, 2017, 2:33pm UTC](https://discuss.elastic.co/t/kv-filter-to-include-spaces-in-selected-fields-values/86733/5 "2017-05-24T14:33:59Z")
Yes. Becoz I need to extract only few values not all. i.e. method, reasonPhrase, RequestUri, Content, ClientID and ID fields only. ---
**Author:** ![Sameer\_Panicker](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Post date:** [May 26, 2017, 2:49pm UTC](https://discuss.elastic.co/t/kv-filter-to-include-spaces-in-selected-fields-values/86733/6 "2017-05-26T14:49:24Z")
Any update on this please ? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 23, 2017, 2:50pm UTC](https://discuss.elastic.co/t/kv-filter-to-include-spaces-in-selected-fields-values/86733/7 "2017-06-23T14:50:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.