# Kv filter with empty value

**URL:** <https://discuss.elastic.co/t/kv-filter-with-empty-value/36267>\
**Category:** Logstash\
**Created:** [December 3, 2015, 9:38am UTC](https://discuss.elastic.co/t/kv-filter-with-empty-value/36267 "2015-12-03T09:38:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sebGA](https://avatars.discourse-cdn.com/v4/letter/s/9fc29f/32.png) [@sebGA](https://discuss.elastic.co/u/sebGA)\
**Post date:** [December 3, 2015, 9:38am UTC](https://discuss.elastic.co/t/kv-filter-with-empty-value/36267/1 "2015-12-03T09:38:15Z")

</div>

Hi,

When using the logstash kv filter with default parameters ( kv { } ), i have problem when parsing a message with empty values.  
See the following examples. The result in the first one is not good as the value associated with the intf\_out key is the following key/value pair.

Example 1 (NOK):  
Source message : "intf\_in=eth0-996 intf\_out= pkt\_len=48"  
kv filter result :

- intf \_in: eth0-996
- intf\_out: pkt\_len=48

Example 2 (OK):  
Source message : "intf\_in=eth1 intf\_out=eth4 pkt\_len=48"  
kv filter result :

- intf \_in: eth0-996
- intf\_out: eth4
- pkt\_len: 48

Is there an option for this filter that could help in getting a correct result (null value or empty value or not creating the key if value is empty) ?

Thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 3, 2015, 9:44am UTC](https://discuss.elastic.co/t/kv-filter-with-empty-value/36267/2 "2015-12-03T09:44:19Z")

</div>

I _think_ the kv filter requires values to be non-empty. Perhaps you could use the mutate filter's gsub option to replace "= " with "=xxx" and use "xxx" (whatever you choose) to indicate that the key was empty?

---

<div class="post-metadata">

**Author:** ![sebGA](https://avatars.discourse-cdn.com/v4/letter/s/9fc29f/32.png) [@sebGA](https://discuss.elastic.co/u/sebGA)\
**Post date:** [December 3, 2015, 10:21am UTC](https://discuss.elastic.co/t/kv-filter-with-empty-value/36267/3 "2015-12-03T10:21:46Z")

</div>

It works great.  
Quick and efficient answer, what else ? 😄

Thanks a lot magnusbaeck.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:20am UTC](https://discuss.elastic.co/t/kv-filter-with-empty-value/36267/4 "2017-07-06T05:20:12Z")

</div>