Logtstash kv

I converted my mysql field value to kv using kv filter...

field_split => "&?"
but when i saw the result....it was in key and value form only...but in string codes...means my line break to kv form but in showing string...

So I am not able to call individual key and value....bcz its again become string...

Is there is any solution...after break string to kv form ....it index in kv form only..not a string..

What does the event/field look like?

Actually I want to send json after logstash fetch data from mysql in this form...
"group" : "fans",
"user" : [
"first" : "John",
"last" : "Smith"
"first" : "Alice",
"last" : "White"

But logstash makes each field of the mysql in seperate key valye form...
and then sending to elasticsearch..
But before send to elasticsearch I want to make my data in the above code way...Is there any possible way...

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.