# Parsing key value pairs from 2 seperate fields into several fields in ingest pipeline

**URL:** <https://discuss.elastic.co/t/parsing-key-value-pairs-from-2-seperate-fields-into-several-fields-in-ingest-pipeline/320782>\
**Category:** Elasticsearch\
**Created:** [December 8, 2022, 12:11pm UTC](https://discuss.elastic.co/t/parsing-key-value-pairs-from-2-seperate-fields-into-several-fields-in-ingest-pipeline/320782 "2022-12-08T12:11:44Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![DennisLC](https://avatars.discourse-cdn.com/v4/letter/d/a9a28c/32.png) [@DennisLC](https://discuss.elastic.co/u/DennisLC)\
**Post date:** [December 8, 2022, 12:11pm UTC](https://discuss.elastic.co/t/parsing-key-value-pairs-from-2-seperate-fields-into-several-fields-in-ingest-pipeline/320782/1 "2022-12-08T12:11:44Z")

</div>

I have just started ingesting 0365 audit logs, and I have come across the following field:  
`o365.audit.ExtraProperties.value`  
that I would like to parse out to several fields (as it contains comma seperated values) in my ingest pipeline.

I know that I could do this by writing some grok patterns, but as there is also a field called `o365.audit.ExtraProperties.key`  
which will always correspond to the above mentioned value field I was wondering if there was an easy way to combine the keys and values of these fields, and then parse them out to individual fields from there.

Here is an example of the two existing fields:

```auto
o365.audit.ExtraProperties.key: TimeZone, OsName, OsVersion, Country, ClientName, ClientVersion, ClientUtcOffsetSecond

```

```auto
o365.audit.ExtraProperties.value: Asia/Saigon, windows, 10, us, skypeteams, 27/1.0.0.2022113005, 25200

```

And what I would like is something like the following fields:

```auto
o365.audit.ExtraProperties.TimeZone: Asia/Saigon,
o365.audit.ExtraProperties.OsName: windows,
o365.audit.ExtraProperties.OsVersion: 10

```

Etc.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 5, 2023, 12:12pm UTC](https://discuss.elastic.co/t/parsing-key-value-pairs-from-2-seperate-fields-into-several-fields-in-ingest-pipeline/320782/2 "2023-01-05T12:12:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.