# KV pairs automatically parsed by logstash?
**URL:** https://discuss.elastic.co/t/kv-pairs-automatically-parsed-by-logstash/355331
**Category:** Logstash
**Created:** [March 13, 2024, 5:02pm UTC](https://discuss.elastic.co/t/kv-pairs-automatically-parsed-by-logstash/355331 "2024-03-13T17:02:19Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Joe\_Martin](https://discuss.elastic.co/u/Joe_Martin)
#### Post date: [March 13, 2024, 5:02pm UTC](https://discuss.elastic.co/t/kv-pairs-automatically-parsed-by-logstash/355331/1 "2024-03-13T17:02:19Z")
I have a device sending syslogs in standard kv pair format; with a comma (,) separating fields and equal (=) separating key from value.
sample:
key1="value1",key2="value2",key3="value3",...
In order to ensure ECS compatibility, I have a kv filter defined with a "target" field set.
In Elastic, I am expecting to only see the kv-parsed fields in the nested field but I am seeing them both at the root AND in the nested field.
Is there some "automatic" parsing that logstash does? If not, why do I see all of these fields at the document root as well as the nested field?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 13, 2024, 5:49pm UTC](https://discuss.elastic.co/t/kv-pairs-automatically-parsed-by-logstash/355331/2 "2024-03-13T17:49:59Z")
> [@Joe\_Martin](#):
>
> Is there some "automatic" parsing that logstash does?
No, there is not. Your configuration must be parsing them twice or copying them.
---
### Author:  [@Joe\_Martin](https://discuss.elastic.co/u/Joe_Martin)
#### Post date: [March 13, 2024, 6:08pm UTC](https://discuss.elastic.co/t/kv-pairs-automatically-parsed-by-logstash/355331/3 "2024-03-13T18:08:27Z")
Perhaps it is the syslog input plugin that is parsing out the kv pairs????
But I have no grok\_pattern defined.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 13, 2024, 6:17pm UTC](https://discuss.elastic.co/t/kv-pairs-automatically-parsed-by-logstash/355331/4 "2024-03-13T18:17:56Z")
> [@Joe\_Martin](#):
>
> Perhaps it is the syslog input plugin that is parsing out the kv pairs????
No, the [default parsing](https://github.com/logstash-plugins/logstash-input-syslog/blob/5d8084da90a48decb11443a41e24735ab0a05886/lib/logstash/inputs/syslog.rb#L98) in a syslog input just parses the [timestamp etc.](https://github.com/logstash-plugins/logstash-patterns-core/blob/f01f3f34cfab13a28b0822bdba33db41823cb1d8/patterns/legacy/linux-syslog#L9)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 10, 2024, 6:17pm UTC](https://discuss.elastic.co/t/kv-pairs-automatically-parsed-by-logstash/355331/5 "2024-04-10T18:17:57Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.