# Logstash kv{} issue with field without any value

**URL:** <https://discuss.elastic.co/t/logstash-kv-issue-with-field-without-any-value/66035>\
**Category:** Logstash\
**Created:** [November 14, 2016, 11:15pm UTC](https://discuss.elastic.co/t/logstash-kv-issue-with-field-without-any-value/66035 "2016-11-14T23:15:01Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![rolfberkenbosch](https://avatars.discourse-cdn.com/v4/letter/r/5fc32e/32.png) [@rolfberkenbosch](https://discuss.elastic.co/u/rolfberkenbosch)\
**Post date:** [November 14, 2016, 11:15pm UTC](https://discuss.elastic.co/t/logstash-kv-issue-with-field-without-any-value/66035/1 "2016-11-14T23:15:01Z")

</div>

Hi there,

I have the following input:  
\<134\> device="SFW" date=2016-11-15 time=00:00:35 timezone="CET" device\_name="SG430" device\_id=S50049065BB50F7 log\_id=010302602002 log\_type="Firewall" log\_component="Appliance Access" log\_subtype="Denied" status="Deny" priority=Information duration=0 fw\_rule\_id=0 policy\_type=0 user\_name="" user\_gp="" iap=0 ips\_policy\_id=0 appfilter\_policy\_id=0 application="" application\_risk=0 application\_technology="" application\_category="" in\_interface="PortMGMT" out\_interface="" src\_mac=78:ac:c0:88:a8:aa src\_ip=0.0.0.0 src\_country\_code= dst\_ip=255.255.255.255 dst\_country\_code= protocol="UDP" src\_port=68 dst\_port=67 sent\_pkts=0 recv\_pkts=0 sent\_bytes=0 recv\_bytes=0 tran\_src\_ip= tran\_src\_port=0 tran\_dst\_ip= tran\_dst\_port=0 srczonetype="" srczone="" dstzonetype="" dstzone="" dir\_disp="" connid="" vconnid="" hb\_health="No Heartbeat"

But logstash index it as follows:

sent\_pkts 0  
src\_country\_code dst\_ip=255.255.255.255  
src\_ip 0.0.0.0

How can I prevent logstash to index key without values. Is there a replacement string that I can run in front. If I find the following: '= ' replace it with '=""' before kv{} does it job.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 15, 2016, 4:52am UTC](https://discuss.elastic.co/t/logstash-kv-issue-with-field-without-any-value/66035/2 "2016-11-15T04:52:30Z")

</div>

What does your config look like?  
What version?

---

<div class="post-metadata">

**Author:** ![rolfberkenbosch](https://avatars.discourse-cdn.com/v4/letter/r/5fc32e/32.png) [@rolfberkenbosch](https://discuss.elastic.co/u/rolfberkenbosch)\
**Post date:** [November 15, 2016, 7:32am UTC](https://discuss.elastic.co/t/logstash-kv-issue-with-field-without-any-value/66035/3 "2016-11-15T07:32:48Z")

</div>

I userd logstash-5.0.0-1

The config is as follows:

input {  
tcp {  
host =\> "172.39.39.111"  
port =\> 5000  
type =\> syslog  
}  
udp {  
port =\> 5000  
type =\> syslog  
}  
}

filter {  
if [type] == "syslog" {  
kv {  
field\_split =\> " "  
include\_brackets =\> false  
}  
date {  
match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]  
}  
geoip {  
source =\> "dst\_ip"  
}  
}  
}

output {  
elasticsearch { hosts =\> ["localhost:9200"] }  
stdout { codec =\> rubydebug }  
}

---

<div class="post-metadata">

**Author:** ![rolfberkenbosch](https://avatars.discourse-cdn.com/v4/letter/r/5fc32e/32.png) [@rolfberkenbosch](https://discuss.elastic.co/u/rolfberkenbosch)\
**Post date:** [November 15, 2016, 8:27am UTC](https://discuss.elastic.co/t/logstash-kv-issue-with-field-without-any-value/66035/4 "2016-11-15T08:27:50Z")

</div>

I find the solutoin, place this in front of KV {}:

mutate {  
gsub =\> [  
"message", "= ", '="" '  
]  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 13, 2016, 8:27am UTC](https://discuss.elastic.co/t/logstash-kv-issue-with-field-without-any-value/66035/5 "2016-12-13T08:27:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.