# Replace Whitespaces In Key's **URL:** \ **Category:** Logstash\ **Created:** [June 6, 2019, 8:17am UTC](https://discuss.elastic.co/t/replace-whitespaces-in-keys/184518 "2019-06-06T08:17:10Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![tomx1](https://avatars.discourse-cdn.com/v4/letter/t/779978/32.png) [@tomx1](https://discuss.elastic.co/u/tomx1)\ **Post date:** [June 6, 2019, 8:17am UTC](https://discuss.elastic.co/t/replace-whitespaces-in-keys/184518/1 "2019-06-06T08:17:10Z")
As we are now collecting access logs of our Checkpoint Firewalls, we are facing the issue of horrible inconsistent key values (so the name of the keys itself 😉 ). They are formated in different ways but I was able to get them into a consistent format whith logstash but there is still one issue: Some keys have a whitespace INSIDE the key name. I need a way to replace whitespaces inside key names with underscores. It seems like the trim\_key option inside the kv filter was able to do this in an earlier version, but someone thought it's not a good idea - see: [https://github.com/logstash-plugins/logstash-filter-kv/issues/10](https://github.com/logstash-plugins/logstash-filter-kv/issues/10) Unfortunately what the "trim\_key" option did in earlier kv filter version is exactly what i would need now. Anyone have an idea how I can accomplish this? ---
**Author:** ![BennyInc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bennyinc/32/21751_2.png) [@BennyInc](https://discuss.elastic.co/u/BennyInc)\ **Post date:** [June 6, 2019, 8:59am UTC](https://discuss.elastic.co/t/replace-whitespaces-in-keys/184518/2 "2019-06-06T08:59:51Z")
I guess you could use the [mutate filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html) to rename the field in multiple steps. 1. Extract field name to a new temporary field (add\_field) 2. Use regex matching to remove white spaces (sub?) 3. Rename field to new name (rename) However I guess if the field name is unknown that would be more tricky. ---
**Author:** ![tomx1](https://avatars.discourse-cdn.com/v4/letter/t/779978/32.png) [@tomx1](https://discuss.elastic.co/u/tomx1)\ **Post date:** [June 6, 2019, 9:12am UTC](https://discuss.elastic.co/t/replace-whitespaces-in-keys/184518/3 "2019-06-06T09:12:00Z")
Well that is something I am already doing \> Just renaming the key via mutate. So for example "destination dns hostname" becomes "destination\_dns\_hostname". But as you have said that is only working if you know the names of all keys. As I'm using kv filter I do not know all key names in advance. New keys can popup everytime so maintaining a "list" is not really a way which scales. ---
**Author:** ![BennyInc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bennyinc/32/21751_2.png) [@BennyInc](https://discuss.elastic.co/u/BennyInc)\ **Post date:** [June 6, 2019, 9:46am UTC](https://discuss.elastic.co/t/replace-whitespaces-in-keys/184518/4 "2019-06-06T09:46:43Z")
If you only need to get the field consistent (because whitespace use varies), you could also remove the whitespaces altogether with the [remove\_char\_key option](https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html#plugins-filters-kv-remove_char_key) in your kv filter: > Contrary to trim option, all characters are removed from the key, whatever their position. ---
**Author:** ![tomx1](https://avatars.discourse-cdn.com/v4/letter/t/779978/32.png) [@tomx1](https://discuss.elastic.co/u/tomx1)\ **Post date:** [June 6, 2019, 10:17am UTC](https://discuss.elastic.co/t/replace-whitespaces-in-keys/184518/5 "2019-06-06T10:17:04Z")
gnah sorry! I did not saw this in the documentation 🙄 🙃 Thank you! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 4, 2019, 10:17am UTC](https://discuss.elastic.co/t/replace-whitespaces-in-keys/184518/6 "2019-07-04T10:17:10Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.