# KV Plugin take only first key from a split\_field Logstash 5.0

**URL:** https://discuss.elastic.co/t/kv-plugin-take-only-first-key-from-a-split-field-logstash-5-0/64499
**Category:** Logstash
**Created:** [October 31, 2016, 11:23pm UTC](https://discuss.elastic.co/t/kv-plugin-take-only-first-key-from-a-split-field-logstash-5-0/64499 "2016-10-31T23:23:10Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![jattilioz](https://avatars.discourse-cdn.com/v4/letter/j/e19adc/32.png) [@jattilioz](https://discuss.elastic.co/u/jattilioz)
#### Post date: [October 31, 2016, 11:23pm UTC](https://discuss.elastic.co/t/kv-plugin-take-only-first-key-from-a-split-field-logstash-5-0/64499/1 "2016-10-31T23:23:10Z")

</div>

Hi All,

Trying to work through this issue I am having parsing with KV plugin. My kv pairs are split with "=" and fields are delimited by "|". A small example below.

src=192.168.1.1|dst=192.168.1.2|resource=http://www.hls.com/Delivery/ClientPaths/Library/hook.js?apiKey=1223b2ff-b4ef-4963-9740-46548797|...

` kv {  
source =\> "message"  
field\_split =\> "(?\<!\)(|)"  
add\_field =\> ["received\_at", "%{@timestamp}"]  
add\_field =\> ["received\_from", "%{host}"]  
}

`  
The problem I am having is KV plugin picks up src, dst and resource, but also apiKey and any others where "=" exists. I want the resource value in its entirety and not broken up. I do not want to take the route of using include\_keys as more logs with different keys could be added in the future.

Any idea how to ignore the other "=" in a field like the resource example?

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [November 1, 2016, 3:52am UTC](https://discuss.elastic.co/t/kv-plugin-take-only-first-key-from-a-split-field-logstash-5-0/64499/2 "2016-11-01T03:52:45Z")

</div>

I do not understand your `field_split` configuration. Have you tried with something like this: `field_split => "\s*|\s*"` ?

---

<div class="post-metadata">

### Author: ![jattilioz](https://avatars.discourse-cdn.com/v4/letter/j/e19adc/32.png) [@jattilioz](https://discuss.elastic.co/u/jattilioz)
#### Post date: [November 1, 2016, 6:13pm UTC](https://discuss.elastic.co/t/kv-plugin-take-only-first-key-from-a-split-field-logstash-5-0/64499/3 "2016-11-01T18:13:47Z")

</div>

I will try this out, the current field split was used to match only "|" instead of occasional "|" (which I also do not want to split as | does not indicate a new field) appearing in the logs. Essentially split on "|" when not lead by a "". Maybe this could be causing issues.

As of right now, it splits key/values correctly unless an extra "=" is in the split field like the case of resource.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:31am UTC](https://discuss.elastic.co/t/kv-plugin-take-only-first-key-from-a-split-field-logstash-5-0/64499/4 "2017-07-06T04:31:43Z")

</div>