Logstash KV filter escape ":"

Elastic Stack Logstash
1

Hello, I have a message here (all message will be like this):

{"Time": "2022-05-12T04:18:46.077", "HostName": "IBMNOAH", "Cat": "JOBLOG", "Severity": "Err", "SAF": 1, "SAFD": "RACF", "Name": "TEST", "JobName": "DBS1MSTR", "JobID": "JOB03954", "Rec": " 23:18:36 ERROR ID=DSNLIRTR000300000000000::172.31.206.121 FOR THREAD WITH"}

This is my code to parse properly:

filter {
    kv {
        value_split => ":"
        remove_char_value => ","
    }
}

The one issue I have is that the value of the final field, "Rec", contains colons : which throws off the kv{} filter. How can I escape those colons so the kv filter grabs everything inside the "" for each key:value pair?

2

As I said in the other thread, use a json filter, not a kv filter.

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.