Logstash ruby code to irritate through a key value map

Elastic Stack Logstash
1

I have this log:
cs1Label=userAuthenticationMechanism cs1=oauth-access-token cs2Label=vcapRequestId cs2=12398012300-c876-4427-56dd-49a7c0e9c254::1dd79781-ee8a-41e6-a630-c9a20f2615e9 cs3Label=result cs3=success cs4Label=httpStatusCode cs4=200 cs5Label=xForwardedFor cs5=52.59.18.156, 10.0.0.11, 10.0.16.102

I need a key/value map filter from it, example.
userAuthenticationMechanism = oauth-access-token
vcapRequestId = 12398012300-c876-4427-56dd-49a7c0e9c254::1dd79781-ee8a-41e6-a630-c9a20f2615e9
result = success

So that I have the key as a field in my kibana with the value from the value :slight_smile:
thanks.

EDIT1:
Better example of what I would need:

xForwardedFor=52.59.18.156, 10.0.0.11, 10.0.16.102

2

Use a grok or csv filter to separate out the list of key-value pairs from the IP addresses and then apply the kv filter to the field that now contains the key-value list.

3

I can't, because the KV filter always searches for the "=" and then finds the key/value, but if you take a look at the logs, what I need is a bit more complex. Let's say the first log:

cs1Label=userAuthenticationMechanism cs1=oauth-access-token
and this is how I would need it:
userAuthenticationMechanism =oauth-access-token

I would need to somehow write a ruby code that always takes the value from the pairs and then combines them so they are correctly.
Just wanted to know if someone has another idea as with the KV.