# Logstash kv filter include\_keys
**URL:** https://discuss.elastic.co/t/logstash-kv-filter-include-keys/50103
**Category:** Logstash
**Created:** [May 16, 2016, 9:04am UTC](https://discuss.elastic.co/t/logstash-kv-filter-include-keys/50103 "2016-05-16T09:04:42Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@sundar](https://discuss.elastic.co/u/sundar)
#### Post date: [May 16, 2016, 9:04am UTC](https://discuss.elastic.co/t/logstash-kv-filter-include-keys/50103/1 "2016-05-16T09:04:42Z")
Hello Logstash experts,
Is it ok to have multiple include\_keys in my kv filter config? I want to avoid parsing all KVs since it is adding a lot of junk KV pairs to my list of fields, so I am whitelisting the keys I am interested in. The whitelist has grown over a period of time. Configtest seems to allow this, and logstash came up fine but I am not seeing the keys I expect, so was wondering if this is wrong:
```
kv {
source => "message"
include_keys => ["received_from", "count", "mean_rate", "m1", "m5", "m15", "min", "max", "mean", "stddev", "median", "p75", "p95", "p98", "p99", "p999"]
include_keys => ["mean_rate", "rate_unit", "duration_unit", "type", "name", "appName", "contextId", "gateway", "route", "deviceId", "messageType", "errStack"]
include_keys => ["errMessage", "messageDir", "mqttTopic", "topic", "allowAnonymous", "stats.allowedWriteCounter", "stats.deniedWriteCounter", "stats.allowedReadCounter"]
trim => "<>\[\],"
trimkey => "<>\[\],"
}
```
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [May 17, 2016, 2:49pm UTC](https://discuss.elastic.co/t/logstash-kv-filter-include-keys/50103/2 "2016-05-17T14:49:11Z")
The docs don't really state you cannot, but does it work?
---
### Author:  [@sundar](https://discuss.elastic.co/u/sundar)
#### Post date: [May 17, 2016, 4:04pm UTC](https://discuss.elastic.co/t/logstash-kv-filter-include-keys/50103/3 "2016-05-17T16:04:27Z")
Update, it works fine (which is good, no need for long lines in config). The issue was something else in my config which caused my test to skip the kv filter altogether.
Thanks
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:57am UTC](https://discuss.elastic.co/t/logstash-kv-filter-include-keys/50103/4 "2017-07-06T04:57:23Z")