KV Filter usage

[bec33 (Bechara Abou Rahal)]

I am following up on this thread,

can you help

KV Filter Pattern Usage

Using the latest KV filter plugin (4.1.0)... I'm trying to use the KV filter to parse a log formatted like the following: Protocol: TCP, SrcIP: 192.168.1.1 and so on... (the main idea here is that the key/values are separated by colon+space and fields are separate by comma+space I've tried the following: filter { if [log_header] =~ "desired_value" { mutate { add_tag => [ "blah" ] } kv { value_split_pattern => ": " field_split_pattern => ", " } } } I'…

[bec33 (Bechara Abou Rahal)]

I found the solution,

event source time was wrong