KV Pair Filter with empty values - Logstash 6.2.3

Elastic Stack Logstash
1

My data comes as follow with the = as the value split and a tab character (shown here as \t) as the field split.

key1=value1\tkey2=value2 \tkey3=\tkey4=\tkey5=value5\

Several of the KV pairs may contain empty values.

In Logstash 6.2.2 the KV pair filter handled these empty values fine. After upgrading to Logstash 6.2.3 the KV pair filter no longer handles it - the value becomes the next KV pair.

My fix for this was to add a mutate filter before the KV pair filter. I used gsub to find empty values and replace with double quotes - (again the tab character is shown here as a \t for readability):

mutate { gsub => [ "message", "=\t", '=""\t' ] }

Anyways I thought I would share my experience in case anyone else has a similiar problem after upgrading Logstash to 6.2.3.

1 Like
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.