Newbie questions about KV filter

Elastic Stack Logstash
1

Hi everyone,

I am new to the ELK stack. I have logs that look like this:

A = B
C = D
E = F

G = H
I = J
K = L

As you can see, each line is a key-value pair. The first three lines are associated together with one event, similarly the next three lines are associated with another event. Different events are separated by an empty new line.

I would like to use KV filter to parse each group of key-value pairs (associated with the same event) as a single message that is consisted of those key-values pairs in the logstash index record. What is the best way to do this in the filter configuration?

Thanks a lot for the help!

2

You'd likely need to run this through the multiline filter to build a single event, and then the KV one to separate that one out.

3

Thanks Mark for the reply, I will give it a try to see if I can make it work.