# Logstash ruby code to irritate through a key value map

**URL:** <https://discuss.elastic.co/t/logstash-ruby-code-to-irritate-through-a-key-value-map/59828>\
**Category:** Logstash\
**Created:** [September 5, 2016, 4:11pm UTC](https://discuss.elastic.co/t/logstash-ruby-code-to-irritate-through-a-key-value-map/59828 "2016-09-05T16:11:22Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aljaz\_Gantar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aljaz_gantar/32/9636_2.png) [@Aljaz\_Gantar](https://discuss.elastic.co/u/Aljaz_Gantar)\
**Post date:** [September 5, 2016, 4:11pm UTC](https://discuss.elastic.co/t/logstash-ruby-code-to-irritate-through-a-key-value-map/59828/1 "2016-09-05T16:11:23Z")

</div>

I have this log:  
`cs1Label=userAuthenticationMechanism cs1=oauth-access-token cs2Label=vcapRequestId cs2=12398012300-c876-4427-56dd-49a7c0e9c254::1dd79781-ee8a-41e6-a630-c9a20f2615e9 cs3Label=result cs3=success cs4Label=httpStatusCode cs4=200 cs5Label=xForwardedFor cs5=52.59.18.156, 10.0.0.11, 10.0.16.102`

I need a key/value map filter from it, example.  
userAuthenticationMechanism = oauth-access-token  
vcapRequestId = 12398012300-c876-4427-56dd-49a7c0e9c254::1dd79781-ee8a-41e6-a630-c9a20f2615e9  
result = success

So that I have the key as a field in my kibana with the value from the value 🙂  
thanks.

EDIT1:  
Better example of what I would need:

> xForwardedFor=52.59.18.156, 10.0.0.11, 10.0.16.102

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [September 5, 2016, 4:20pm UTC](https://discuss.elastic.co/t/logstash-ruby-code-to-irritate-through-a-key-value-map/59828/2 "2016-09-05T16:20:02Z")

</div>

Use a grok or csv filter to separate out the list of key-value pairs from the IP addresses and then apply the kv filter to the field that now contains the key-value list.

---

<div class="post-metadata">

**Author:** ![Aljaz\_Gantar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aljaz_gantar/32/9636_2.png) [@Aljaz\_Gantar](https://discuss.elastic.co/u/Aljaz_Gantar)\
**Post date:** [September 5, 2016, 8:04pm UTC](https://discuss.elastic.co/t/logstash-ruby-code-to-irritate-through-a-key-value-map/59828/3 "2016-09-05T20:04:27Z")

</div>

I can't, because the KV filter always searches for the "=" and then finds the key/value, but if you take a look at the logs, what I need is a bit more complex. Let's say the first log:

> cs1Label=userAuthenticationMechanism cs1=oauth-access-token  
> and this is how I would need it:  
> userAuthenticationMechanism =oauth-access-token

I would need to somehow write a ruby code that always takes the value from the pairs and then combines them so they are correctly.  
Just wanted to know if someone has another idea as with the KV.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:39am UTC](https://discuss.elastic.co/t/logstash-ruby-code-to-irritate-through-a-key-value-map/59828/4 "2017-07-06T04:39:47Z")

</div>