# Kv plugin behavior
**URL:** https://discuss.elastic.co/t/kv-plugin-behavior/149304
**Category:** Logstash
**Created:** [September 20, 2018, 1:44pm UTC](https://discuss.elastic.co/t/kv-plugin-behavior/149304 "2018-09-20T13:44:57Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@alan.frabutt](https://discuss.elastic.co/u/alan.frabutt)
#### Post date: [September 20, 2018, 1:44pm UTC](https://discuss.elastic.co/t/kv-plugin-behavior/149304/1 "2018-09-20T13:44:58Z")
Greetings all,
I believe I've made a solid effort digging around other posts (and sites) for more info, but I'm not getting traction. The behavior I'd expect from the code below is that it would break out each kv pair in the messages field into discrete searchable things. Not seeing that tho.
```
filter {
if [type] == "syslog" {
mutate {
gsub => ["message", "\"", ""]
gsub => ["message", ": ", "="]
}
kv {
source => "message"
include_keys => ["sysloghost", "severity", "facility", "programname", "procid"]
}
}
}
```
Any obvious problems with that?
Many thanks in advance!
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 20, 2018, 5:35pm UTC](https://discuss.elastic.co/t/kv-plugin-behavior/149304/2 "2018-09-20T17:35:46Z")
What does the input look like? What output do you get?
---
### Author:  [@alan.frabutt](https://discuss.elastic.co/u/alan.frabutt)
#### Post date: [September 20, 2018, 7:18pm UTC](https://discuss.elastic.co/t/kv-plugin-behavior/149304/3 "2018-09-20T19:18:16Z")
Thanks for the prompt response! 1st I'd like to verify I'm not operating under false assumptions. If I were to configure logstash with the syslog input plugin, and direct a vanilla Linux rsyslogd log stream to it, then output to elasticsearch, should I expect kibana to show the individual kv pairs inside the message field to exist as searchable fields? I'm sanitizing example data now for upload.
---
### Author:  [@yaauie](https://discuss.elastic.co/u/yaauie)
#### Post date: [September 20, 2018, 7:59pm UTC](https://discuss.elastic.co/t/kv-plugin-behavior/149304/4 "2018-09-20T19:59:07Z")
The KV filter plugin allows you to specify your `field_split` and `value_split` character classes (or even full splitter patterns with `field_split_pattern` and `value_split_pattern` in later releases); it is also pretty good at capturing quoted values. You might not need to do gsub operations to clean up the data before invoking the kv filter.
Docs for current version are [here](https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html).
---
### Author:  [@alan.frabutt](https://discuss.elastic.co/u/alan.frabutt)
#### Post date: [September 24, 2018, 3:53pm UTC](https://discuss.elastic.co/t/kv-plugin-behavior/149304/5 "2018-09-24T15:53:56Z")
Let's just close this one out... the problem doesn't appear to have anything to do with kv. I've tried following the example at
[https://www.elastic.co/blog/how-to-centralize-logs-with-rsyslog-logstash-and-elasticsearch-on-ubuntu-14-04](https://www.elastic.co/blog/how-to-centralize-logs-with-rsyslog-logstash-and-elasticsearch-on-ubuntu-14-04), and I'm getting \_jasonparsefailure, so I'll try to follow that breadcrumb trail.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 22, 2018, 3:53pm UTC](https://discuss.elastic.co/t/kv-plugin-behavior/149304/6 "2018-10-22T15:53:58Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.