KV Whitespace Question

Elastic Stack Logstash
1

I am trying to figure out a way to either:

  1. Replace all spaces in the field with underscores
    OR
  2. Capture the entire string with the spaces into the field.

Every solution that I have found does not work so far. I've looked throughout the documentation of the filter itself and the mutate filter as well.

Sample Log:
[ REMARKS = An attempt was made to access an object. ]

What the current output is:
"remarks" => "An"

Configuration:

image
image.png480×508 18.4 KB

Please help. All is appreciated.

2

I would not use kv for that. How about this?...

    dissect { mapping => { "message" => "[ %{[@metadata][fieldname]} = %{[@metadata][fieldvalue]} ]" } }
    mutate { add_field => { "%{[@metadata][fieldname]}" => "%{[@metadata][fieldvalue]}" } }
3

Thank you for your reply.

I tried what you suggested and I did not do the trick. Is there a way to change the default delimiter of KV?

4

Yes. Either field_split or value_split (or the _pattern versions of these) depending on what you want to change

5

Okay, Ill give that a shot. Thank you.

Can I only do a single delimiter with kv or can I do multiple? Because I would have to capture fieldname between "[" and "=", then the field data between "=" and "]". As shown below

[ SOURCE = XXX-XX-XX ] [ REMARKS = An attempt was made to access an object. ]

Last time I appempted this, all of the fieldnames worked but the data within them was "][ ".

Thanks again.

6

Read the documentation. It supports both multiple characters and regexps for both field and value delimiters.

7

I just got it to work! Thanks for your help. @Badger