# Kv filter with spaces in values

**URL:** <https://discuss.elastic.co/t/kv-filter-with-spaces-in-values/227962>\
**Category:** Logstash\
**Created:** [April 14, 2020, 4:20pm UTC](https://discuss.elastic.co/t/kv-filter-with-spaces-in-values/227962 "2020-04-14T16:20:59Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![parosio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/parosio/32/27367_2.png) [@parosio](https://discuss.elastic.co/u/parosio)\
**Post date:** [April 14, 2020, 4:21pm UTC](https://discuss.elastic.co/t/kv-filter-with-spaces-in-values/227962/1 "2020-04-14T16:21:00Z")

</div>

Hello,  
I've got a log that seems a perfect candidate for the kv filter:

```auto
msg=Start MID 1242272 ICID 1632662 categorySignificance=/Informational catdt=Web Filtering categoryObject=/Host/Application/Service deviceSeverity=Info rt=1582506453000

```

and so on ...

but, as you can see, there are values that contain space(s).  
The first field, for example, is `msg` and should contain `Start MID 1242272 ICID 1632662`, but the filter simply stops at the first space, as for the `catdt` field, giving:

```auto
    {
                         "msg" => "Start",
                          "rt" => "1582506453000",
              "deviceSeverity" => "Info",
                  "@timestamp" => 2020-04-14T15:49:28.031Z,
                       "catdt" => "Web",
              "categoryObject" => "/Host/Application/Service",
                    "@version" => "1",
        "categorySignificance" => "/Informational",
    }

```

The number of fields may vary.

Is it possible to have the filter to consider as value everything from "=" to the first letter of the next key, where a key is anything matching a "notspace\*=" `([^ =]+)=` pattern ?

---

<div class="post-metadata">

**Author:** ![parosio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/parosio/32/27367_2.png) [@parosio](https://discuss.elastic.co/u/parosio)\
**Post date:** [April 14, 2020, 4:44pm UTC](https://discuss.elastic.co/t/kv-filter-with-spaces-in-values/227962/2 "2020-04-14T16:44:09Z")

</div>

Found a viable answer on stackoverflow:

> <https://stackoverflow.com/questions/48703747/kv-fiter-not-including-space-values>

Essentially, put a separator (comma, in the example) before each key:

```auto
mutate {
  gsub => ["message", "(\S+=)", ", \1"]
}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 14, 2020, 4:44pm UTC](https://discuss.elastic.co/t/kv-filter-with-spaces-in-values/227962/3 "2020-04-14T16:44:57Z")

</div>

You could do that in a ruby filter by scaning the string for a regexp and then adding the key / value pairs to the event. Something like [this](https://discuss.elastic.co/t/how-to-split-the-one-field-into-multiple-fields-using-kv-plugins/172067/4).

---

<div class="post-metadata">

**Author:** ![parosio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/parosio/32/27367_2.png) [@parosio](https://discuss.elastic.co/u/parosio)\
**Post date:** [April 15, 2020, 3:20pm UTC](https://discuss.elastic.co/t/kv-filter-with-spaces-in-values/227962/4 "2020-04-15T15:20:29Z")

</div>

Thank you @Badger,  
in the end, I resorted to use multiple groks instead of a kv.

I have logs with ten/twenty rows referring to a single logical document, each with dozens of fields (not always all, or in the same order). The average row size is 5kB. The whole file has some millions of rows.

I only need to extract a few fields, so multiple groks seem to be much more efficient.

Now I'm facing the problem of script-updating an array field for these documents.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 13, 2020, 3:29pm UTC](https://discuss.elastic.co/t/kv-filter-with-spaces-in-values/227962/5 "2020-05-13T15:29:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.