# Logstash filtering
**URL:** https://discuss.elastic.co/t/logstash-filtering/174570
**Category:** Logstash
**Created:** [March 29, 2019, 4:13pm UTC](https://discuss.elastic.co/t/logstash-filtering/174570 "2019-03-29T16:13:30Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)
#### Post date: [March 29, 2019, 4:13pm UTC](https://discuss.elastic.co/t/logstash-filtering/174570/1 "2019-03-29T16:13:30Z")
How do you filter something that has multiple of the same Keys. in my "message" i have 3 different \_id keys.
im currently using kv to split up my data , but it is showing all 3 values into that 1 key
Its not working correctly. Let me see if this makes more sense
The message is `
`"_id": "2345345c-97e3453535", "event_id": 78406744, "event_values": {"processEvent/processCmdLine": "C:\WINDOWS\tasksche.exe /i", "processEvent/parentPid": 1756, "processEvent/processPath": "C:\Windows\tasksche.exe", "url": "dfgdfgfdgd", "hostname": "dfgdgdfgd", "primary_ip_address": "345345353",, "_id": "6756757567"}, "is_false_positive": false, "event_at": "2019-03-27T02:35:08.039Z", "source": "gdfgd", "matched_at": "2019-03-27T02:35:40.000Z", "url": "sfdsdfsdfsf", "_id": 334545,``
I am using kv to split it
kv {
#split by Commas, value defined by equal sign , and exclude fields
field\_split =\> ","
value\_split =\> ":"
}
But how do i keep these 3 \_ID seperated because it is outputting like
\_id": "2345345c-97e3453535", "6756757567"}, : 334545,`
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 29, 2019, 4:23pm UTC](https://discuss.elastic.co/t/logstash-filtering/174570/2 "2019-03-29T16:23:13Z")
If you have multiple fields with the same key then a kv filter will create an array. What else would you like it to do?
---
### Author:  [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)
#### Post date: [March 29, 2019, 5:14pm UTC](https://discuss.elastic.co/t/logstash-filtering/174570/3 "2019-03-29T17:14:16Z")
```
key1:value2,key1:value2,key1:value3
```
Would would I rename the keys into 3 different keys with these values
I dont want key1 : value1, value2, value3
i want newkey: value1
newkey:value2
newkey:value3
---
### Author:  [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)
#### Post date: [March 29, 2019, 5:18pm UTC](https://discuss.elastic.co/t/logstash-filtering/174570/5 "2019-03-29T17:18:57Z")
Or is there a way to pass each keypair into a new field
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 29, 2019, 5:33pm UTC](https://discuss.elastic.co/t/logstash-filtering/174570/6 "2019-03-29T17:33:16Z")
Well you do not say exactly what you want, but you could add additional fields using a ruby filter.
```
kv { }
ruby {
code => '
foo = event.get("foo")
if foo.kind_of?(Array)
foo.each_index { |x|
event.set("foo#{x}", foo[x])
}
end
'
}
```
which will turn
```
"message" => "foo=a foo=b foo=c",
```
into
```
"foo0" => "a",
"foo1" => "b",
"foo2" => "c"
```
---
### Author:  [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)
#### Post date: [March 29, 2019, 6:19pm UTC](https://discuss.elastic.co/t/logstash-filtering/174570/7 "2019-03-29T18:19:58Z")
> [@Badger](#):
>
> t you could add additional fields usin
im assuming foo is the key that is has multiple values in it ?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 29, 2019, 6:36pm UTC](https://discuss.elastic.co/t/logstash-filtering/174570/8 "2019-03-29T18:36:39Z")
> [@Elk\_huh](#):
>
> im assuming foo is the key that is has multiple values in it ?
Yes, as you can see in the "message" field that I am parsing.
---
### Author:  [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)
#### Post date: [March 29, 2019, 6:41pm UTC](https://discuss.elastic.co/t/logstash-filtering/174570/9 "2019-03-29T18:41:02Z")
Its not working correctly. Let me see if this makes more sense
The message is `
`"_id": "2345345c-97e3453535", "event_id": 78406744, "event_values": {"processEvent/processCmdLine": "C:\WINDOWS\tasksche.exe /i", "processEvent/parentPid": 1756, "processEvent/processPath": "C:\Windows\tasksche.exe", "url": "dfgdfgfdgd", "hostname": "dfgdgdfgd", "primary_ip_address": "345345353",, "_id": "6756757567"}, "is_false_positive": false, "event_at": "2019-03-27T02:35:08.039Z", "source": "gdfgd", "matched_at": "2019-03-27T02:35:40.000Z", "url": "sfdsdfsdfsf", "_id": 334545,``
I am using kv to split it
kv {
#split by Commas, value defined by equal sign , and exclude fields
field\_split =\> ","
value\_split =\> ":"
}
But how do i keep these 3 \_ID seperated because it is outputting like
\_id": "2345345c-97e3453535", "6756757567"}, : 334545,`
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 29, 2019, 6:51pm UTC](https://discuss.elastic.co/t/logstash-filtering/174570/10 "2019-03-29T18:51:54Z")
With that message I get two separate fields on the event, one of which has a leading space on the field name.
```
"\"_id\"" => "2345345c-97e3453535",
" \"_id\"" => [
[0] "\"6756757567\"}",
[1] "334545"
],
```
If I change field\_split to include a space
```
field_split => " ,"
```
Then I get the 3 ids in a single array and that ruby filter I posted will work.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 26, 2019, 7:00pm UTC](https://discuss.elastic.co/t/logstash-filtering/174570/11 "2019-04-26T19:00:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.