# Logstash KV Filter Help

**URL:** <https://discuss.elastic.co/t/logstash-kv-filter-help/246199>\
**Category:** Logstash\
**Created:** [August 24, 2020, 11:09pm UTC](https://discuss.elastic.co/t/logstash-kv-filter-help/246199 "2020-08-24T23:09:13Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![kopacko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kopacko/32/10733_2.png) [@kopacko](https://discuss.elastic.co/u/kopacko)\
**Post date:** [August 24, 2020, 11:09pm UTC](https://discuss.elastic.co/t/logstash-kv-filter-help/246199/1 "2020-08-24T23:09:13Z")

</div>

I am working on a project and I have setup a chatbot that connects to Twitch chat channels.

I am trying to parse chat messages and having some issues related to a KV filter.

An example log looks like this:  
`@badge-info=<BADGE>/<LEVEL>;badges=<BADGE>/<LEVEL>,<BADGE>/<LEVEL>,<BADGE>/<LEVEL>;client-nonce=<DATA>;color=#<DATA>;display-name=<DATA>;emotes=<DATA>;flags=<DATA>;id=<DATA>;mod=<DATA>;room-id=<DATA>;subscriber=<DATA>;tmi-sent-ts=<DATA>;turbo=<DATA>;user-id=<DATA>;user-type=<DATA> :<DATA>!<DATA>@<DATA>.tmi.twitch.tv <DATA> #<DATA> :<GREEDYDATA>`

The problem I am running into is the final KV pair which is:  
`user-type=<DATA> :`

That final key/value pair is hardly populated and what ends up happening is I get randomness parsed into it's place:

- channel\_kv.user-type =\> :cool\_beans!cool\_beans@cool\_beans.tmi.twitch.tv
- channel\_kv.user-type =\> :tmi.twitch.tv
- channel\_kv.user-type =\> :bonj\_\_!bonj\_\_@bonj\_\_.tmi.twitch.tv

A correct parse, where the field does exist, looks like this:

`@badge-info=subscriber/37;badges=moderator/1,subscriber/36,partner/1;color=#5B99FF;display-name=StreamElements;emotes=;flags=84-107:;id=ce777d2c-4d39-4125-978f-56a4f793e892;mod=1;room-id=37402112;subscriber=1;tmi-sent-ts=1598219388089;turbo=0;user-id=100135110;user-type=mod :streamelements!streamelements@streamelements.tmi.twitch.tv PRIVMSG #shroud :<GREEDYDATA>`

- channel\_kv.user-type =\> mod

I am not sure how to overcome this hurdle and need some guidance.

Thanks all!

---

<div class="post-metadata">

**Author:** ![kopacko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kopacko/32/10733_2.png) [@kopacko](https://discuss.elastic.co/u/kopacko)\
**Post date:** [August 27, 2020, 1:07am UTC](https://discuss.elastic.co/t/logstash-kv-filter-help/246199/2 "2020-08-27T01:07:42Z")

</div>

No one?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 24, 2020, 1:07am UTC](https://discuss.elastic.co/t/logstash-kv-filter-help/246199/3 "2020-09-24T01:07:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.