# Logstash KV parsing : k=field, v=value

**URL:** https://discuss.elastic.co/t/logstash-kv-parsing-k-field-v-value/131044
**Category:** Logstash
**Created:** [May 8, 2018, 5:20pm UTC](https://discuss.elastic.co/t/logstash-kv-parsing-k-field-v-value/131044 "2018-05-08T17:20:59Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![joaoantoniopereira](https://avatars.discourse-cdn.com/v4/letter/j/a88e57/32.png) [@joaoantoniopereira](https://discuss.elastic.co/u/joaoantoniopereira)
#### Post date: [May 8, 2018, 5:20pm UTC](https://discuss.elastic.co/t/logstash-kv-parsing-k-field-v-value/131044/1 "2018-05-08T17:20:59Z")

</div>

Hi,  
I am trying to use Logstash KV filter and I am having some difficulties. After some Logstash processing I get the following field "new\_parsed":  
`"new_parsed" => "{n=Tuner_TotalHolePackets, v=0},{n=Tuner_TotalPacketsExpired, v=0},{n=Tuner_TotalPacketsReceived, v=845775},{n=Tuner_HoleTooLarge, v=0}`

I would like to parse the "new\_parsed" field to get each value for each field name:  
"Tuner\_TotalHolePackets" =\> "0",  
"Tuner\_TotalPacketsExpired" =\> "0",  
"Tuner\_TotalPacketsReceived" =\> "845775",  
"Tuner\_HoleTooLarge" =\> "0",

Does anyone know would to do this?  
Thank you for your attention

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 8, 2018, 7:30pm UTC](https://discuss.elastic.co/t/logstash-kv-parsing-k-field-v-value/131044/2 "2018-05-08T19:30:46Z")

</div>

I suspect the kv filter can't do this, but it would be trivial with a ruby filter.

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 8, 2018, 8:51pm UTC](https://discuss.elastic.co/t/logstash-kv-parsing-k-field-v-value/131044/3 "2018-05-08T20:51:34Z")

</div>

One such ruby filter would be

```auto
  ruby {
    code => '
      s = event.get("tuner_new")
      s.scan( /\{n=([^,]+), v=([^}]+)\}/ ) { |n, v| event.set(n , v) }
    '
  }

```

Error checking is left as an exercise for the reader.

---

<div class="post-metadata">

### Author: ![joaoantoniopereira](https://avatars.discourse-cdn.com/v4/letter/j/a88e57/32.png) [@joaoantoniopereira](https://discuss.elastic.co/u/joaoantoniopereira)
#### Post date: [May 8, 2018, 9:22pm UTC](https://discuss.elastic.co/t/logstash-kv-parsing-k-field-v-value/131044/4 "2018-05-08T21:22:27Z")

</div>

Thank you very much @Badger it worked perfectly fine!  
Regards, João

---

<div class="post-metadata">

### Author: ![zqc0512](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zqc0512/32/32141_2.png) [@zqc0512](https://discuss.elastic.co/u/zqc0512)
#### Post date: [May 9, 2018, 12:52am UTC](https://discuss.elastic.co/t/logstash-kv-parsing-k-field-v-value/131044/5 "2018-05-09T00:52:26Z")

</div>

this as a json file replica =\> as :

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 6, 2018, 12:52am UTC](https://discuss.elastic.co/t/logstash-kv-parsing-k-field-v-value/131044/6 "2018-06-06T00:52:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.