# Parsing nested key/value pairs with kv
**URL:** https://discuss.elastic.co/t/parsing-nested-key-value-pairs-with-kv/33536
**Category:** Logstash
**Created:** [November 2, 2015, 3:54pm UTC](https://discuss.elastic.co/t/parsing-nested-key-value-pairs-with-kv/33536 "2015-11-02T15:54:19Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@gogators](https://discuss.elastic.co/u/gogators)
#### Post date: [November 2, 2015, 3:54pm UTC](https://discuss.elastic.co/t/parsing-nested-key-value-pairs-with-kv/33536/1 "2015-11-02T15:54:19Z")
I'm trying to parse a log file that is composed of key/value pairs separated by '='. The problem I have is that some of the keys need to be interpreted as nested objects. For example a log line might look like this:
> 11/02/2015 09:51:59 key1=val\_1 key2=val\_2 object1.field1=val\_11 object1.field2=val\_12 key3=val\_3 ....
I do not know _apriori_ all the possible keys or fields. But there is a limited set of objects. The order of appearance on a line is also unknown. The kv filter creates field names like "object1.field1". Later I want to use the elasticsearch output plug to index the log messages and I need it as an nested field within the document, e.g.
```
{
"key1": "val_1",
"object1": {
"field1": "val_11",
"field2": "val_12"
}
"key2": "val_2",
"key3": "val_3"
}
```
How can parse these into nested objects?
---
### Author:  [@treksler](https://discuss.elastic.co/u/treksler)
#### Post date: [June 28, 2016, 10:31pm UTC](https://discuss.elastic.co/t/parsing-nested-key-value-pairs-with-kv/33536/2 "2016-06-28T22:31:33Z")
Did you ever figure out an efficient way to do this?
I am currently thinking of using grok to parse out the object.submessage pairs and then using kv to parse the key value pairs in the submessage and using target to send them up to the object, instead of rootlevel
---
### Author:  [@gogators](https://discuss.elastic.co/u/gogators)
#### Post date: [August 30, 2016, 7:59pm UTC](https://discuss.elastic.co/t/parsing-nested-key-value-pairs-with-kv/33536/3 "2016-08-30T19:59:53Z")
Basically, I'm using kv include\_keys with object.fieldX values. Then I use 'rename': "Object.fieldX" =\> " [Object][fieldX]" to put it in an actual object. I'm lucky since I know all the object \<=\> field pairs that I care about. There might be others, but they are unimportant to me. I still don't know how to capture them all.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:40am UTC](https://discuss.elastic.co/t/parsing-nested-key-value-pairs-with-kv/33536/4 "2017-07-06T04:40:47Z")