Parse KV:s beginning with a <XXX>key=value

[Elitlogik]

Is there a way to easily remove the leading in a key-value sequence?

<XXX>key1=value1 key2=value2 key3=value3

Filter looks like this now:

filter { kv {} }

Thank you for your support!

[Badger]

You can do it with mutate

mutate { gsub => [ "message", "^<\d+>", "" ] }

[Elitlogik]

@Badger

mutate { gsub => [ "message", "^<\d+>", "" ] }

Thank you very much for the solution! You also learned me how the filter is working.