I'm using the kv plugin to extract data from Windows ForwardedEvents. Typical data to process looks like: Client Version: 1.21.204.0 Client Policy ID: e964d551-3d3c-4a8f-8b9c-a99cce9b7ce5 IP Addresses: 192.168.0.10 Process Name: MSIP.App Action: Download Policy KV splits by ':' into, e.g. "Client…

KV generated field names contain spoaces and capitals

magnusbaeck (Magnus Bäck) April 13, 2018, 11:54am 2

You can use a ruby filter. I'm pretty sure examples of that have been posted in the past.

Topic		Replies	Views
Using kv to produce fields with every word capitalized Logstash	3	521	August 20, 2020
Adding prefex to the field extracted via KV plugin Logstash	4	447	July 21, 2021
Help on case sensitive kv plugin Logstash	4	592	September 8, 2017
Using KV processors when field names have space Elasticsearch	2	836	September 9, 2020
Lowercase all fields and sub fields Logstash	2	2711	April 27, 2019

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

KV generated field names contain spoaces and capitals

Related topics