# Logstasg KV

**URL:** <https://discuss.elastic.co/t/logstasg-kv/115537>\
**Category:** Logstash\
**Created:** [January 15, 2018, 12:09pm UTC](https://discuss.elastic.co/t/logstasg-kv/115537 "2018-01-15T12:09:28Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![neo\_levi](https://avatars.discourse-cdn.com/v4/letter/n/e5b9ba/32.png) [@neo\_levi](https://discuss.elastic.co/u/neo_levi)\
**Post date:** [January 15, 2018, 12:09pm UTC](https://discuss.elastic.co/t/logstasg-kv/115537/1 "2018-01-15T12:09:28Z")

</div>

Hi All, i am new to logstash kv , i am tring to parse message that look like  
{"HOSTNAME":"XXX","level":"INFO","logger\_name":"elkUaLog","serviceName":"services-log","profile":"localdev","eurekaInstanceId":"services-log:2fe14fcfac1ad6581d7dc967b10463aa","message":"user-activity","eventName":"user-activity","eventType":"change","elementType":"input","inputType":"checkbox","fieldName":"deal.treatmentLead.cb163d89dbe-d6e7-4684-b9f1-37d2ef73380f","value":true,"timestamp":"1/15/2018, 1:25:06 PM","timeSinceStarted":"4.0 Sec","browser":"Chrome 63"}

i wrote filter

kv {  
{ field\_split =\> ",?"},  
{ source =\> "message" },  
{ value\_split =\> ":" }

}

but i am getting error  
can any one help ?

---

<div class="post-metadata">

**Author:** ![Krunal\_kalaria](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krunal_kalaria/32/23862_2.png) [@Krunal\_kalaria](https://discuss.elastic.co/u/Krunal_kalaria)\
**Post date:** [January 15, 2018, 12:33pm UTC](https://discuss.elastic.co/t/logstasg-kv/115537/2 "2018-01-15T12:33:52Z")

</div>

hi @neo_levi,

I think you should try CSV filter plugin its working properly

csv  
{

---

<div class="post-metadata">

**Author:** ![Krunal\_kalaria](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krunal_kalaria/32/23862_2.png) [@Krunal\_kalaria](https://discuss.elastic.co/u/Krunal_kalaria)\
**Post date:** [January 15, 2018, 12:34pm UTC](https://discuss.elastic.co/t/logstasg-kv/115537/3 "2018-01-15T12:34:03Z")

</div>

csv  
{

---

<div class="post-metadata">

**Author:** ![Krunal\_kalaria](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krunal_kalaria/32/23862_2.png) [@Krunal\_kalaria](https://discuss.elastic.co/u/Krunal_kalaria)\
**Post date:** [January 15, 2018, 12:34pm UTC](https://discuss.elastic.co/t/logstasg-kv/115537/4 "2018-01-15T12:34:56Z")

</div>

csv  
{  
separator =\> ","  
}  
sorry for above message its take automatically entered

---

<div class="post-metadata">

**Author:** ![Krunal\_kalaria](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krunal_kalaria/32/23862_2.png) [@Krunal\_kalaria](https://discuss.elastic.co/u/Krunal_kalaria)\
**Post date:** [January 15, 2018, 12:35pm UTC](https://discuss.elastic.co/t/logstasg-kv/115537/5 "2018-01-15T12:35:36Z")

</div>

Otherwise you can take  
json  
{  
source =\> "message"  
}

---

<div class="post-metadata">

**Author:** ![neo\_levi](https://avatars.discourse-cdn.com/v4/letter/n/e5b9ba/32.png) [@neo\_levi](https://discuss.elastic.co/u/neo_levi)\
**Post date:** [January 15, 2018, 2:54pm UTC](https://discuss.elastic.co/t/logstasg-kv/115537/6 "2018-01-15T14:54:34Z")

</div>

Tnx Krunal, the json filter works

---

<div class="post-metadata">

**Author:** ![Krunal\_kalaria](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krunal_kalaria/32/23862_2.png) [@Krunal\_kalaria](https://discuss.elastic.co/u/Krunal_kalaria)\
**Post date:** [January 16, 2018, 4:24am UTC](https://discuss.elastic.co/t/logstasg-kv/115537/7 "2018-01-16T04:24:09Z")

</div>

🙂😊

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 13, 2018, 4:24am UTC](https://discuss.elastic.co/t/logstasg-kv/115537/8 "2018-02-13T04:24:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.