# Parse key value pair only from the parenthesis

**URL:** <https://discuss.elastic.co/t/parse-key-value-pair-only-from-the-parenthesis/148286>\
**Category:** Logstash\
**Created:** [September 12, 2018, 9:19am UTC](https://discuss.elastic.co/t/parse-key-value-pair-only-from-the-parenthesis/148286 "2018-09-12T09:19:35Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mohit\_Sakarkar](https://avatars.discourse-cdn.com/v4/letter/m/f475e1/32.png) [@Mohit\_Sakarkar](https://discuss.elastic.co/u/Mohit_Sakarkar)\
**Post date:** [September 12, 2018, 9:19am UTC](https://discuss.elastic.co/t/parse-key-value-pair-only-from-the-parenthesis/148286/1 "2018-09-12T09:19:36Z")

</div>

Hi,

I am new in logstash, I have large file of tomcat application log and I need to parse only request and response which is available in key value pair form in square brackets, please see request and response below from the large log file:

**REQUEST**  
09/09/2018 23:40:02:388 INFO eivrLogger Hashcode: 1487574513 method: EIVR\_nedLookupAttributeRouting - dW20180909233811001D1165b306c76f - NEDLookupAttributeRoutingRequest Object : NedLookupAttributeRoutingRequest [applicationName=WESTEIVR, dasSessionId=dW20180909233811001D1165b306c76f, telephonyUID=dW20180909233811001D1165b306c76f, ani=1234556757, dnis=7895647, ced=null, language=ENG, vuiBusinessHierarchyElement=com.comcast.ned.common.types.BusinessHierarchyElement@736a30d2, enteredZipCode=25698, divisionHierarchyName=DIV\_NORTHEAST, regionHierarchyName=REG\_FREEDOM, marketHierarchyName=MKT\_PHILADELPHIA\_PA\_AREA\_1\_PA, corpSysprinHiearchyName=849910002, accountNumber=849910002512345, accountType=RESIDENTIAL, trunkType=null, browserSessionId=, browserGrpName=DEFAULT\_BROWSER\_GROUP\_NAME, browserHostName=, callFlowPoint=ROUTING\_LOOKUP, keyValuePairs=KeyValuePairs [keyValueData=[KeyValueData [key=Module, value=Technical], KeyValueData [key=Type, value=HSI], KeyValueData [key=SubType, value=WirelessGateway], KeyValueData [key=Extension, value=], KeyValueData [key=Term, value=795158012345]]]]

**RESPONSE**  
Final NEDLookupAttributeRoutingResponse Object: NedLookupAttributeRoutingResponse [extAttrRtgAction=TRANSFER, dialString=795158012345, setupString=null, terminationString=null, transferType=SIPREF\_UUI, overrideReasonName=PRS\_0\_30\_WIFI, callFlowBranchLabel=null, attributeRoutingServer=null, attributeRoutingUID=403237476, keyValuePairs=KeyValuePairs [keyValueData=[KeyValueData [key=NOT\_NEWLOB\_COS\_OVERRIDE, value=TRUE], KeyValueData [key=PRS\_0\_30, value=TRUE], KeyValueData [key=ID, value=TRUE]]]]

Please suggest to parse both request and response as one record.

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 10, 2018, 9:19am UTC](https://discuss.elastic.co/t/parse-key-value-pair-only-from-the-parenthesis/148286/2 "2018-10-10T09:19:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.