# The Kv plugin, field\_split uses spaces to cut, but the value contains spaces. Value cutting is incomplete

**URL:** https://discuss.elastic.co/t/the-kv-plugin-field-split-uses-spaces-to-cut-but-the-value-contains-spaces-value-cutting-is-incomplete/146834
**Category:** Logstash
**Created:** [August 31, 2018, 8:57am UTC](https://discuss.elastic.co/t/the-kv-plugin-field-split-uses-spaces-to-cut-but-the-value-contains-spaces-value-cutting-is-incomplete/146834 "2018-08-31T08:57:04Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![sun\_changlong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sun_changlong/32/39036_2.png) [@sun\_changlong](https://discuss.elastic.co/u/sun_changlong)
#### Post date: [August 31, 2018, 8:57am UTC](https://discuss.elastic.co/t/the-kv-plugin-field-split-uses-spaces-to-cut-but-the-value-contains-spaces-value-cutting-is-incomplete/146834/1 "2018-08-31T08:57:04Z")

</div>

My data format is:  
`evel="2" treatment="3" cmd="\"D:\Program Files (x86)\360\360safe\modules\setup.exe\" /s /smartsilence" type="sys"`

Use the kv plugin, use " " to cut, and then use "=" to parse, but the value of the cmd field contains the escape character and contains the cut character.

The hope is that:

> key = cmd  
> value = "D:\Program Files (x86)\360\360safe\modules\setup.exe" /s /smartsilence

but, the result is :

> key = cmd  
> value = "D:\Program

or

> key = cmd  
> value = "D:\Program Files (x86)\360\360safe\modules\setup.exe

```
kv {
       source => "message"
       field_split => " ?"
       value_split => "="
 }

```

or

```
kv {
       source => "message"
       field_split => " ?"
       value_split => "="
       trim_value => "\" "
 }

```

Can the kv plugin achieve the results I expected? How to operate?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 28, 2018, 8:57am UTC](https://discuss.elastic.co/t/the-kv-plugin-field-split-uses-spaces-to-cut-but-the-value-contains-spaces-value-cutting-is-incomplete/146834/2 "2018-09-28T08:57:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.