# Nested key-values parsed with KV
**URL:** https://discuss.elastic.co/t/nested-key-values-parsed-with-kv/257625
**Category:** Logstash
**Created:** [December 4, 2020, 8:21am UTC](https://discuss.elastic.co/t/nested-key-values-parsed-with-kv/257625 "2020-12-04T08:21:10Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Elitlogik](https://discuss.elastic.co/u/Elitlogik)
#### Post date: [December 4, 2020, 8:21am UTC](https://discuss.elastic.co/t/nested-key-values-parsed-with-kv/257625/1 "2020-12-04T08:21:10Z")
KV works great for parsing my input.
One key-value, however, looks like this:
```auto
waninfo="name=wan1,bytes=35911872068/568034814778,packets=135560453/438026267;name=wan2,bytes=0/0,packets=0/0;"
```
I would like to KV-parse that value into:
```auto
name1:wan1
bytes_sent1:35911872068
bytes_received1:568034814778
packets_sent1:135560453
packets_received1:438026267
name2:wan2
bytes_sent2:35911872068
bytes_received2:568034814778
packets_sent2:135560453
packets_received2:438026267
```
Depending on the complexity added to filter I would like to:
1. Parse N iterations (example shows 2, but there could possibly be N)
2. If 1 is too comples just parse the first iteration and output:
```auto
wan1_bytes_sent:35911872068
wan1_bytes_received:568034814778
wan1_packets_sent:135560453
wan1_packets_received:438026267
```
Current filter is just like this:
```auto
filter {
mutate { gsub => ["message", "^<\d+>", ""] }
kv { }
}
```
Thank you very much for your support! I'm learning slowly π
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 4, 2020, 3:21pm UTC](https://discuss.elastic.co/t/nested-key-values-parsed-with-kv/257625/2 "2020-12-04T15:21:36Z")
Do you really want the values from wan1 copied to wan2? If so, is that unconditional or is there some logic to whether or not it should be done.
I have not tested it but you could try
```
mutate { split => { "wan_info" => ";" } }
split { field => "wan_info" }
dissect { mapping => { "wan_info" => "name=%{name},bytes=%{bytes_sent}/%{bytes_received},packets=%{packets_sent}/%{packets_recevied}" } }
```
---
### Author:  [@Elitlogik](https://discuss.elastic.co/u/Elitlogik)
#### Post date: [December 5, 2020, 8:41pm UTC](https://discuss.elastic.co/t/nested-key-values-parsed-with-kv/257625/3 "2020-12-05T20:41:23Z")
Hi,
No, of course not. Just simple logic. I want to take care of the data as Fields in Elastic. It was a mistake to grab the values for wan1 and put into the wan2 fieldas. Wan2 data should all have been 0.
Should I append your code after the kv {} statement, or should it be pasted between the brackets of the kv { your code }?
Thank you very much for your support!
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 5, 2020, 9:04pm UTC](https://discuss.elastic.co/t/nested-key-values-parsed-with-kv/257625/4 "2020-12-05T21:04:35Z")
Remove the kv filter and replace it with the three filters I showed.
---
### Author:  [@Elitlogik](https://discuss.elastic.co/u/Elitlogik)
#### Post date: [December 5, 2020, 11:07pm UTC](https://discuss.elastic.co/t/nested-key-values-parsed-with-kv/257625/5 "2020-12-05T23:07:03Z")
Hmm. I still have a lot of key-value pairs that KV parses and generates fields for just perfectly.
Itβs just that one key-value (waninfo) that I would like to parse the value of and create additional fields.
key1=value1 key2=value2 ... waninfo=β name=wan1,bytes=A1/A2,packets=B1/B2;name=wan2,bytes=C1/C2,packets=D1/D2;β ... keyN=valueN
The wan1\_bytes\_sent=A1 should be created and on the same level as the other keys key1, key2 etc
Either just grab A1, A2, B1 and B2 and statically produce wan1\_bytes\_sent field and set it to A1, wan1\_bytes\_received and set it to A2, or dynamically create (name)\_bytes\_sent and set it to A1 etc because the number of name=,bytes=,packets= sequence could be infinite or zero.
Thank you for your support!
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 5, 2020, 11:21pm UTC](https://discuss.elastic.co/t/nested-key-values-parsed-with-kv/257625/6 "2020-12-05T23:21:36Z")
In that case add my code after the kv filter.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 2, 2021, 11:22pm UTC](https://discuss.elastic.co/t/nested-key-values-parsed-with-kv/257625/7 "2021-01-02T23:22:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.