# Logstash\_KVFilter
**URL:** https://discuss.elastic.co/t/logstash-kvfilter/211605
**Category:** Logstash
**Created:** [December 12, 2019, 9:45am UTC](https://discuss.elastic.co/t/logstash-kvfilter/211605 "2019-12-12T09:45:51Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)
#### Post date: [December 12, 2019, 9:45am UTC](https://discuss.elastic.co/t/logstash-kvfilter/211605/1 "2019-12-12T09:45:51Z")
Hi There,
Am trying to split the fileds and values of this field
winlog.event\_data.RuleName: technique\_id=T1036,technique\_name=Masquerading
in two other separate fields where I can have technique id separately and technique name separately
filter {
if "winlogbeat" in [tags] and [log\_name] == "Microsoft-Windows-Sysmon/Operational" {
kv { source =\> "[winlog][event\_data][RuleName]" target =\> "[winlog][event\_data][RuleName]" field\_split =\> "," }
}
}
Could you please tell me what error am I making , I could'nt split these
---
### Author:  [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)
#### Post date: [December 13, 2019, 9:26am UTC](https://discuss.elastic.co/t/logstash-kvfilter/211605/2 "2019-12-13T09:26:44Z")
any help please ?
---
### Author:  [@ahmedmusaad](https://discuss.elastic.co/u/ahmedmusaad)
#### Post date: [January 2, 2020, 2:56pm UTC](https://discuss.elastic.co/t/logstash-kvfilter/211605/3 "2020-01-02T14:56:49Z")
Hi Raj,
There a couple of things you need to change in your filter syntax to achieve the results you are looking for, try replacing your filter with this following one:
```
filter {
if ([winlog][channel] == "Microsoft-Windows-Sysmon/Operational") {
if ([winlog][event_data][RuleName]) {
kv {
source => "[winlog][event_data][RuleName]"
field_split => ","
value_split => "="
prefix => "mitre_"
transform_key => "lowercase"
}
}
}
}
```
I have tested the filter above and it works, you will get the new fields with the information from the RuleName field. Feel feel to share any questions or thoughts.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 30, 2020, 2:56pm UTC](https://discuss.elastic.co/t/logstash-kvfilter/211605/4 "2020-01-30T14:56:55Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.