# Logstash Key Value Filter unable to parse specific text

**URL:** <https://discuss.elastic.co/t/logstash-key-value-filter-unable-to-parse-specific-text/60145>\
**Category:** Logstash\
**Created:** [September 9, 2016, 9:09am UTC](https://discuss.elastic.co/t/logstash-key-value-filter-unable-to-parse-specific-text/60145 "2016-09-09T09:09:58Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mrunalgosar](https://avatars.discourse-cdn.com/v4/letter/m/eada6e/32.png) [@mrunalgosar](https://discuss.elastic.co/u/mrunalgosar)\
**Post date:** [September 9, 2016, 9:09am UTC](https://discuss.elastic.co/t/logstash-key-value-filter-unable-to-parse-specific-text/60145/1 "2016-09-09T09:09:58Z")

</div>

I am trying to use Logstash's Key Value (kv) filter to parse logs. It specifically fails for a pair where key is "valid". see below example:

> Log message: "versionInfo=VersionInfo{valid=test}"

Logstash filter config snippet for Key value pair:

> filter {  
> kv {  
> source =\> "message"  
> field\_split =\> "\{,\}"  
> trim =\> "\{\}\[\]"  
> }  
> }

Error:

> "\_type"=\>"log", "\_id"=\>"AVcOLhG06gVwm51zjV4A", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse [valid]", "caused\_by"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"Invalid format: "test""}}}}, :level=\>:warn}

But the same filter parses the message successfully if i remove the "valid" text and replace it with some other text like:

> "versionInfo=VersionInfo{field=test}"

What is special for the "valid" text because of which parsing fails?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 9, 2016, 9:38am UTC](https://discuss.elastic.co/t/logstash-key-value-filter-unable-to-parse-specific-text/60145/2 "2016-09-09T09:38:27Z")

</div>

This isn't the kv filter complaining, it's Elasticsearch. What's the mapping of the `valid` field?

---

<div class="post-metadata">

**Author:** ![mrunalgosar](https://avatars.discourse-cdn.com/v4/letter/m/eada6e/32.png) [@mrunalgosar](https://discuss.elastic.co/u/mrunalgosar)\
**Post date:** [September 9, 2016, 9:51am UTC](https://discuss.elastic.co/t/logstash-key-value-filter-unable-to-parse-specific-text/60145/3 "2016-09-09T09:51:56Z")

</div>

Hi Thanks for your reply. For now i've resolved it by using mutate filter and replacing valid text with \_valid.  
But for my knowledge and reference I would like to understand what do you mean by mapping? The log message has the word "valid" as is in it.  
Excerpts from the log:

> "versionInfo=VersionInfo{valid=test}"

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 9, 2016, 10:48am UTC](https://discuss.elastic.co/t/logstash-key-value-filter-unable-to-parse-specific-text/60145/4 "2016-09-09T10:48:26Z")

</div>

> For now i've resolved it by using mutate filter and replacing valid text with \_valid.

You should treat all field names that begin with underscore as reserved, i.e. don't use them.

> But for my knowledge and reference I would like to understand what do you mean by mapping?

Please read about mappings in the Elasticsearch documentation. The `valid` field in your index has most likely been mapped as something that isn't compatible with the string "test".

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:39am UTC](https://discuss.elastic.co/t/logstash-key-value-filter-unable-to-parse-specific-text/60145/5 "2017-07-06T04:39:07Z")

</div>