# Parsing KV where value is a list

**URL:** <https://discuss.elastic.co/t/parsing-kv-where-value-is-a-list/134831>\
**Category:** Logstash\
**Created:** [June 6, 2018, 2:47pm UTC](https://discuss.elastic.co/t/parsing-kv-where-value-is-a-list/134831 "2018-06-06T14:47:22Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![thegrockq](https://avatars.discourse-cdn.com/v4/letter/t/9fc348/32.png) [@thegrockq](https://discuss.elastic.co/u/thegrockq)\
**Post date:** [June 6, 2018, 2:47pm UTC](https://discuss.elastic.co/t/parsing-kv-where-value-is-a-list/134831/1 "2018-06-06T14:47:22Z")

</div>

I have a log I can mostly parse w/ the KV filter. I have a few fields that aren't parsing correctly though as the values are a list instead of a single value. For example:

..., rand\_key: rand\_value, IP Address: (192.168.1.1, 192.168.1.2, 192.168.1.3), rand\_key2: rand\_val2, ...

I'd like to be able to preserve the IP addresses as an IP data type, not a string. Currently I get an error in logs saying IP Address is not an IP string literal and it appears the message is not indexed.

Ideally, this would parse into duplicate keys (e.g. IP\_Addr), in the same document, each with a different value, but I don't know that this is possible. I can grok this out into IP\_Addr1, IP\_Addr2, IPAddr3, and drop empty fields, but I'm hoping there's a cleaner, simpler option using the KV filter.

Anyone have any suggestions?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 6, 2018, 3:26pm UTC](https://discuss.elastic.co/t/parsing-kv-where-value-is-a-list/134831/2 "2018-06-06T15:26:33Z")

</div>

A field can be an array of ip\_addr.

![AA1](https://us1.discourse-cdn.com/elastic/original/3X/f/b/fb9974a4b36abc8c67a48b8794912d46c2bb713b.png)

To convert '(192.168.1.1, 192.168.1.2, 192.168.1.3)' to an array I would use

```
mutate { gsub => ["message", " ", "", "message", "[()]", "" ] }
mutate { split => { "message" => "," } }
mutate { rename => { "message" => "ip_addr" } }

```

Since there are commas inside the parentheses a kv filter is not going to work as is. I would grok everything between 'IP Address: (' and ')' to give you something the above would process. Then gsub it away leaving you something kv will handle.

---

<div class="post-metadata">

**Author:** ![thegrockq](https://avatars.discourse-cdn.com/v4/letter/t/9fc348/32.png) [@thegrockq](https://discuss.elastic.co/u/thegrockq)\
**Post date:** [June 6, 2018, 3:47pm UTC](https://discuss.elastic.co/t/parsing-kv-where-value-is-a-list/134831/3 "2018-06-06T15:47:25Z")

</div>

This is great - thank you. I didn't know about the gsub mutate setting. I'll try this this afternoon.

---

<div class="post-metadata">

**Author:** ![thegrockq](https://avatars.discourse-cdn.com/v4/letter/t/9fc348/32.png) [@thegrockq](https://discuss.elastic.co/u/thegrockq)\
**Post date:** [June 14, 2018, 9:33pm UTC](https://discuss.elastic.co/t/parsing-kv-where-value-is-a-list/134831/4 "2018-06-14T21:33:06Z")

</div>

Sorry for the delayed response - I've been out of town. This is working perfectly as of today. Thanks again!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 12, 2018, 9:33pm UTC](https://discuss.elastic.co/t/parsing-kv-where-value-is-a-list/134831/5 "2018-07-12T21:33:08Z")

</div>

Closed on July 12, 2018, 9:33pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.