Kv plugin recursive bug?

Elastic Stack Logstash
1

I am getting an unexpected output using the kv plugin with recursive = true. With multiple levels of recursion it does not appear to parse as expected. I am using Logstash version 2.3.2, logstash-filter-kv (2.0.7)

My test input message is:
item1=[item1-subitem1=item1-subitem1-value, item1-subitem2=[item1-subitem2-subitem2A=item1-subitem2-subitem2A-value, item1-subitem2-subitem2B=item1-subitem2-subitem2B-value]], item2=item2-value

My logstash kv filter is:
kv {
recursive => "true"
field_split => ","
}

The output generated (in json) is:
"item1": {
"item1-subitem1": "item1-subitem1-value",
"item1-subitem2": {
"[item1-subitem2-subitem2A": "item1-subitem2-subitem2A-value"
},
"item1-subitem2-subitem2B": "item1-subitem2-subitem2B-value"
},
"item2": "item2-value"

The output I expected (in json) is:
"item1": {
"item1-subitem1": "item1-subitem1-value",
"item1-subitem2": {
"item1-subitem2-subitem2A": "item1-subitem2-subitem2A-value"
"item1-subitem2-subitem2B": "item1-subitem2-subitem2B-value"
},
},
"item2": "item2-value"

It looks like it is not handling the brackets "[", "]" correctly for the multiple levels of recursion. Has anyone else experienced this?

1 Like
2

Hi Shane,

For recursive to work, you need to specify different types to brackets for different levels.
Supported brackets: square '[]', parenthesis '()', and angled '<>'
Following input gives expected results:

item1=[item1-subitem1=item1-subitem1-value, item1-subitem2=(item1-subitem2-subitem2A=item1-subitem2-subitem2A-value, item1-subitem2-subitem2B=item1-subitem2-subitem2B-value)], item2=item2-value

{
      "@version" => "1",
    "@timestamp" => "2016-11-04T23:50:20.460Z",
          "path" => "/work/elk/logstash/logstash-2.3.4/winTest/temp3.txt",
          "host" => "BDSPUKA00000258",
          "item1" => {
            "item1-subitem1" => "item1-subitem1-value",
            "item1-subitem2" => {
              "item1-subitem2-subitem2A" => "item1-subitem2-subitem2A-value",
              "item1-subitem2-subitem2B" => "item1-subitem2-subitem2B-value"
            }
          },
          "item2" => "item2-value"
        }
}