# Kv plugin recursive bug?

**URL:** <https://discuss.elastic.co/t/kv-plugin-recursive-bug/52452>\
**Category:** Logstash\
**Created:** [June 10, 2016, 2:51pm UTC](https://discuss.elastic.co/t/kv-plugin-recursive-bug/52452 "2016-06-10T14:51:19Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Shane\_Daniel](https://avatars.discourse-cdn.com/v4/letter/s/7ba0ec/32.png) [@Shane\_Daniel](https://discuss.elastic.co/u/Shane_Daniel)\
**Post date:** [June 10, 2016, 2:51pm UTC](https://discuss.elastic.co/t/kv-plugin-recursive-bug/52452/1 "2016-06-10T14:51:20Z")

</div>

I am getting an unexpected output using the kv plugin with recursive = true. With multiple levels of recursion it does not appear to parse as expected. I am using Logstash version 2.3.2, logstash-filter-kv (2.0.7)

My test input message is:  
item1=[item1-subitem1=item1-subitem1-value, item1-subitem2=[item1-subitem2-subitem2A=item1-subitem2-subitem2A-value, item1-subitem2-subitem2B=item1-subitem2-subitem2B-value]], item2=item2-value

My logstash kv filter is:  
kv {  
recursive =\> "true"  
field\_split =\> ","  
}

The output generated (in json) is:  
"item1": {  
"item1-subitem1": "item1-subitem1-value",  
"item1-subitem2": {  
"[item1-subitem2-subitem2A": "item1-subitem2-subitem2A-value"  
},  
"item1-subitem2-subitem2B": "item1-subitem2-subitem2B-value"  
},  
"item2": "item2-value"

The output I expected (in json) is:  
"item1": {  
"item1-subitem1": "item1-subitem1-value",  
"item1-subitem2": {  
"item1-subitem2-subitem2A": "item1-subitem2-subitem2A-value"  
"item1-subitem2-subitem2B": "item1-subitem2-subitem2B-value"  
},  
},  
"item2": "item2-value"

It looks like it is not handling the brackets "[", "]" correctly for the multiple levels of recursion. Has anyone else experienced this?

---

<div class="post-metadata">

**Author:** ![singrahu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/singrahu/32/12985_2.png) [@singrahu](https://discuss.elastic.co/u/singrahu)\
**Post date:** [November 4, 2016, 11:56pm UTC](https://discuss.elastic.co/t/kv-plugin-recursive-bug/52452/2 "2016-11-04T23:56:00Z")

</div>

Hi Shane,

For **recursive** to work, you need to specify different types to brackets for different levels.  
Supported brackets: **square**'[]', **parenthesis**'()', and **angled**'\<\>'  
Following input gives expected results:

`item1=[item1-subitem1=item1-subitem1-value, item1-subitem2=(item1-subitem2-subitem2A=item1-subitem2-subitem2A-value, item1-subitem2-subitem2B=item1-subitem2-subitem2B-value)], item2=item2-value`

```
{
      "@version" => "1",
    "@timestamp" => "2016-11-04T23:50:20.460Z",
          "path" => "/work/elk/logstash/logstash-2.3.4/winTest/temp3.txt",
          "host" => "BDSPUKA00000258",
          "item1" => {
            "item1-subitem1" => "item1-subitem1-value",
            "item1-subitem2" => {
              "item1-subitem2-subitem2A" => "item1-subitem2-subitem2A-value",
              "item1-subitem2-subitem2B" => "item1-subitem2-subitem2B-value"
            }
          },
          "item2" => "item2-value"
        }
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:30am UTC](https://discuss.elastic.co/t/kv-plugin-recursive-bug/52452/3 "2017-07-06T04:30:58Z")

</div>