# KV generated field names contain spoaces and capitals
**URL:** https://discuss.elastic.co/t/kv-generated-field-names-contain-spoaces-and-capitals/127963
**Category:** Logstash
**Created:** [April 13, 2018, 11:13am UTC](https://discuss.elastic.co/t/kv-generated-field-names-contain-spoaces-and-capitals/127963 "2018-04-13T11:13:06Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@leoponton](https://discuss.elastic.co/u/leoponton)
#### Post date: [April 13, 2018, 11:13am UTC](https://discuss.elastic.co/t/kv-generated-field-names-contain-spoaces-and-capitals/127963/1 "2018-04-13T11:13:06Z")
I'm using the kv plugin to extract data from Windows ForwardedEvents. Typical data to process looks like:
```
Client Version: 1.21.204.0
Client Policy ID: e964d551-3d3c-4a8f-8b9c-a99cce9b7ce5
IP Addresses: 192.168.0.10
Process Name: MSIP.App
Action: Download Policy
```
KV splits by ':' into, e.g.
"`Client Version" : "1.21.204.0"`
I can't find a way to generate the fieldnames replacing the space and lowercasing, e.g.
`"Client Version" -> "client_version"`
There is a large number of fields to deal with so I would rather process them programatically than explicitly change each one by name.
Is there a way to do this?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 13, 2018, 11:54am UTC](https://discuss.elastic.co/t/kv-generated-field-names-contain-spoaces-and-capitals/127963/2 "2018-04-13T11:54:56Z")
You can use a ruby filter. I'm pretty sure examples of that have been posted in the past.
---
### Author:  [@leoponton](https://discuss.elastic.co/u/leoponton)
#### Post date: [April 13, 2018, 1:41pm UTC](https://discuss.elastic.co/t/kv-generated-field-names-contain-spoaces-and-capitals/127963/3 "2018-04-13T13:41:11Z")
Thanks. I'm not a ruby programmer but I tried this. It didn't work. I'm sure my mistake is blindingly obvious...
```
ruby{
code => "
event.to_hash.each { |k,v|
k.gsub(/[]/, '_')
}
"
}
```
---
### Author:  [@leoponton](https://discuss.elastic.co/u/leoponton)
#### Post date: [April 16, 2018, 1:59pm UTC](https://discuss.elastic.co/t/kv-generated-field-names-contain-spoaces-and-capitals/127963/4 "2018-04-16T13:59:00Z")
Okay, this is what I did ... eventually:
```
ruby{
# rename fields to lowercase replacing space with _
code => "
event.to_hash.keys.each { |key|
v = event.get(key)
event.remove(key)
event.set(key.gsub(/ /, '_').downcase, v)
}
"
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 14, 2018, 1:59pm UTC](https://discuss.elastic.co/t/kv-generated-field-names-contain-spoaces-and-capitals/127963/5 "2018-05-14T13:59:10Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.