Parse KV:s beginning with a <XXX>key=value

Is there a way to easily remove the leading in a key-value sequence?

<XXX>key1=value1 key2=value2 key3=value3

Filter looks like this now:

filter { kv {} }

Thank you for your support!

You can do it with mutate

mutate { gsub => [ "message", "^<\d+>", "" ] }

Thank you very much for the solution! You also learned me how the filter is working.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.