# Need help on kibana for visualize from kv filter

**URL:** https://discuss.elastic.co/t/need-help-on-kibana-for-visualize-from-kv-filter/96890
**Category:** Kibana
**Created:** [August 14, 2017, 12:52am UTC](https://discuss.elastic.co/t/need-help-on-kibana-for-visualize-from-kv-filter/96890 "2017-08-14T00:52:20Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![Amity4](https://avatars.discourse-cdn.com/v4/letter/a/da6949/32.png) [@Amity4](https://discuss.elastic.co/u/Amity4)
#### Post date: [August 14, 2017, 12:52am UTC](https://discuss.elastic.co/t/need-help-on-kibana-for-visualize-from-kv-filter/96890/1 "2017-08-14T00:52:20Z")

</div>

so, i need to change this message to column and filter it with type=traffic , subtype=forward and visualize it. can anyone help me? thankyou

![-](https://us1.discourse-cdn.com/elastic/original/3X/f/b/fbe6f78672ddc4d8c3b2fc08902f825de1aa1e10.PNG)

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 14, 2017, 5:31am UTC](https://discuss.elastic.co/t/need-help-on-kibana-for-visualize-from-kv-filter/96890/2 "2017-08-14T05:31:56Z")

</div>

> so, i need to change this message to column

I don't understand.

> and filter it with type=traffic , subtype=forward and visualize it.

Use a grok filter to separate "\<189\>" from the rest of the message. Feed the remainder ("date=2017-08-14" and onwards) to a kv filter.

---

<div class="post-metadata">

### Author: ![Amity4](https://avatars.discourse-cdn.com/v4/letter/a/da6949/32.png) [@Amity4](https://discuss.elastic.co/u/Amity4)
#### Post date: [August 15, 2017, 1:35am UTC](https://discuss.elastic.co/t/need-help-on-kibana-for-visualize-from-kv-filter/96890/3 "2017-08-15T01:35:41Z")

</div>

i'm new to this, can you give me an example of kv filter? still confused on how to use kv filter. thankyou

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 15, 2017, 5:11am UTC](https://discuss.elastic.co/t/need-help-on-kibana-for-visualize-from-kv-filter/96890/4 "2017-08-15T05:11:19Z")

</div>

The kv filter documentation contains a very simple example of how to parse exactly the kind of data you have. The only thing I'll add is that the filter defaults to parsing the contents of the `message` field. If you use a grok filter to separate `<189>` from the key=value pairs the latter might end up in a different field and then you'll have to use the kv filter's `source` option to select that field.

---

<div class="post-metadata">

### Author: ![Amity4](https://avatars.discourse-cdn.com/v4/letter/a/da6949/32.png) [@Amity4](https://discuss.elastic.co/u/Amity4)
#### Post date: [August 15, 2017, 6:05am UTC](https://discuss.elastic.co/t/need-help-on-kibana-for-visualize-from-kv-filter/96890/5 "2017-08-15T06:05:32Z")

</div>

thankyou for your explanation, i already can use the kv filter and now i want to visualize it. can you help me to visualize it ? cause if i click the filter on kibana, there's no visualize under it. thankyou

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 15, 2017, 7:23am UTC](https://discuss.elastic.co/t/need-help-on-kibana-for-visualize-from-kv-filter/96890/6 "2017-08-15T07:23:54Z")

</div>

I suggest you ask Kibana questions in the Kibana category.

---

<div class="post-metadata">

### Author: ![Amity4](https://avatars.discourse-cdn.com/v4/letter/a/da6949/32.png) [@Amity4](https://discuss.elastic.co/u/Amity4)
#### Post date: [August 16, 2017, 12:35am UTC](https://discuss.elastic.co/t/need-help-on-kibana-for-visualize-from-kv-filter/96890/7 "2017-08-16T00:35:29Z")

</div>

okay i'm gonna move it. thankyou ^^

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 13, 2017, 12:35am UTC](https://discuss.elastic.co/t/need-help-on-kibana-for-visualize-from-kv-filter/96890/8 "2017-09-13T00:35:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
