# Logstash KV filter time field
**URL:** https://discuss.elastic.co/t/logstash-kv-filter-time-field/279183
**Category:** Logstash
**Tags:** elastic-stack-monitoring, elastic-stack-security
**Created:** [July 20, 2021, 3:44pm UTC](https://discuss.elastic.co/t/logstash-kv-filter-time-field/279183 "2021-07-20T15:44:21Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@RaonyO](https://discuss.elastic.co/u/RaonyO)
#### Post date: [July 20, 2021, 3:44pm UTC](https://discuss.elastic.co/t/logstash-kv-filter-time-field/279183/1 "2021-07-20T15:44:22Z")
hello guys, i'm using kv filter to filter syslogs in logstash to be sent to elasticsearch. but the kv is creating a field with time and data instead of being in value, how to fix this?
is reaching the field limit because one is being created every time
here is my settings:
```auto
filter {
kv {
field_split => "||"
value_split => "="
allow_duplicate_values => false
source => "message"
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 20, 2021, 4:51pm UTC](https://discuss.elastic.co/t/logstash-kv-filter-time-field/279183/2 "2021-07-20T16:51:46Z")
If your data is not key-value pairs (and it is obviously not) then use grok or dissect to extract the key-value data from the message. See [this](https://discuss.elastic.co/t/parsing-firewall-logs-in-logstash/212786/2) example.
---
### Author:  [@RaonyO](https://discuss.elastic.co/u/RaonyO)
#### Post date: [July 20, 2021, 6:01pm UTC](https://discuss.elastic.co/t/logstash-kv-filter-time-field/279183/3 "2021-07-20T18:01:15Z")
hello @Badger , thanks for the help, I saw the link to the example you sent but I couldn't implement it, can you help me with the filter?
anyway, thanks!
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 20, 2021, 6:15pm UTC](https://discuss.elastic.co/t/logstash-kv-filter-time-field/279183/4 "2021-07-20T18:15:39Z")
You have not given any indication of what your data looks like, so I cannot possibly suggest a pattern to match it.
---
### Author:  [@RaonyO](https://discuss.elastic.co/u/RaonyO)
#### Post date: [July 20, 2021, 6:54pm UTC](https://discuss.elastic.co/t/logstash-kv-filter-time-field/279183/5 "2021-07-20T18:54:04Z")
sorry, i just forgot, here it is:
```auto
"<13>Jul 20 15:27:30 10.241.20.6 time=1626801326|hostname=MGMT-XX|severity=Informational|confidence_level=Medium|product=IPS|action=Detect|ifdir=inbound|ifname=lo|loguid={9x10f3e5yy,0x1c,0x6475cf72,0xeec2e5bc}|origin=xx.xxx.131.3|originsicname=CN\\=FW01-Out,O\\=MGJ.br.atootc|sequencenum=42|time=1626801326|version=5|attack=SSL Enforcement Violation|attack_info=OpenSSL ChaCha20_Poly1305 Cipher Suites|description_url=CVE_2016_7054_help.html|dst=xxx.xx.35.20|https_inspection_action=Inspect|industry_reference=CVE-2016-7054|lastupdatetime=1626805676|log_id=2|malware_rule_id={13B84A4D-2280-4C37-A24E-6FD1377AE144}|performance_impact=3|policy=FRA-POLICY|policy_time=1625860876|protection_id=asm_dynamic_prop_CVE_2016_7054|protection_name=OpenSSL ChaCha20_Poly1305 Cipher Suites|protection_type=IPS|proto=6|received_bytes=3000|rule_name=Webmail|rule_uid=584d05b2-3722-4729-XXXX-XXXX1f7a7b4|s_port=591XX|sent_bytes=1947|service=XXX|session_id={0x60f6e642e,0x3c,0x6475cf72,0xeec2e5bc}|smartdefense_profile=XXXX-IDS|src=xxx.xxx.249.124|suppressed_logs=30|layer_name=IPS|layer_name=F-POLICY Threat Prevention|layer_name=IPS|layer_name=FRA-POLICY Threat Prevention|layer_name=IPS|layer_name=FRA-POLICY Threat Prevention|layer_name=IPS|layer_name=FRA-POLICY Threat Prevention|layer_name=IPS|layer_name=FRA-POLICY Threat Prevention|layer_uuid={364B9452-D032-4D02-8358-XXXXXXX}
```
and here is my output conf:
```auto
output {
elasticsearch { hosts => ["https://XX.XX.XX.160:9200"]
codec => cef
user => "xxxxxx"
password => "XXXXXXXXX"
ssl_certificate_verification => false
index => "syslog" }
stdout { codec => rubydebug }
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 20, 2021, 7:21pm UTC](https://discuss.elastic.co/t/logstash-kv-filter-time-field/279183/6 "2021-07-20T19:21:12Z")
Please do not start multiple threads for the same request.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 17, 2021, 7:22pm UTC](https://discuss.elastic.co/t/logstash-kv-filter-time-field/279183/7 "2021-08-17T19:22:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.