I had a problem when the key-value pair like this ip= error_code=404.the result would be ip=error_code=404。
A recent update to the kv filter added the ability to specify complete patterns for field and value splitters.
You'll need to upgrade the plugin:
bin/logstash-plugin update logstash-filter-kv
Once you have done this, we can define the field_split_pattern to be "EITHER a space OR any word-break that is followed by something that looks like a key":
( |\b(?=[a-z_]+=))
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.