# Logstash kv and regex
**URL:** https://discuss.elastic.co/t/logstash-kv-and-regex/57117
**Category:** Logstash
**Created:** [August 3, 2016, 2:43pm UTC](https://discuss.elastic.co/t/logstash-kv-and-regex/57117 "2016-08-03T14:43:52Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@dihpierrick](https://discuss.elastic.co/u/dihpierrick)
#### Post date: [August 3, 2016, 2:43pm UTC](https://discuss.elastic.co/t/logstash-kv-and-regex/57117/1 "2016-08-03T14:43:52Z")
Hi,
I have got a question concerning the KV filter.
Is it possible to use an regexp to get only the key matching the regex ? ?
For example, if the message is :
`t_1=qsdfgh t_2=ploki p_1=nbvcx t_3=azerty`
I would like to use the KV filter only to retrieve t\_1=qsdfgh, t\_2=ploki and t\_3=azerty.
So my idea is to use a regexp. something like this for example [t.\*]. That way, the p\_1 isn't collected.
I saw the option default\_keys and include\_keys, but i'm not sure there are usefull.
Regards
---
### Author:  [@bhatch](https://discuss.elastic.co/u/bhatch)
#### Post date: [August 3, 2016, 7:31pm UTC](https://discuss.elastic.co/t/logstash-kv-and-regex/57117/2 "2016-08-03T19:31:35Z")
Do you have a wide variety of numbers? For example would you have T\_1 all the way up to T\_900? Or is it just 1-3?
Include\_keys is useful if you know exactly which keys you want. For your example above you would just include T\_1, T\_2, and T\_3. Anything other than those three would be ignored. However this only works if you have a small number of fields and you know exactly what they are named.
---
### Author:  [@dihpierrick](https://discuss.elastic.co/u/dihpierrick)
#### Post date: [August 4, 2016, 6:45am UTC](https://discuss.elastic.co/t/logstash-kv-and-regex/57117/3 "2016-08-04T06:45:51Z")
Hi, Thank for your answer.
It was just an example. In fact there is a lot of fields, all begin with tk\_ .
But I can't know which one will be in the log. That why I would like to use a regexp to match all field begin with tk\_.
😛
---
### Author:  [@dihpierrick](https://discuss.elastic.co/u/dihpierrick)
#### Post date: [August 4, 2016, 7:58am UTC](https://discuss.elastic.co/t/logstash-kv-and-regex/57117/4 "2016-08-04T07:58:36Z")
It seems that the prune plugin can make the job.
---
### Author:  [@dihpierrick](https://discuss.elastic.co/u/dihpierrick)
#### Post date: [August 4, 2016, 9:06am UTC](https://discuss.elastic.co/t/logstash-kv-and-regex/57117/5 "2016-08-04T09:06:32Z")
Does anybody already use this filter ?
I try to use the whitelist\_names option with this regex :
```
prune{
whitelist_names => ["tk_\w*"]
}
```
but nothing goes into Elasticsearch. And of course nothing appears in the logstash log file.
Hoping someone could help me 😛
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:44am UTC](https://discuss.elastic.co/t/logstash-kv-and-regex/57117/6 "2017-07-06T04:44:55Z")