Use kv filter on newline & return split pattern

Elastic Stack Logstash
1

Hi, I am trying to use kv filter to parse the below logs

Name: abc\r\nAge: 39\r\nGender: Male\r\nSalary: 87

My kv filter is as below
kv {
source => "log"
field_split_pattern => "\\\r\\\n"
value_split => ":"
}

I have tried with different field_split_pattern as \r\n, \\r\\n & \\\r\\\n but nothing seems to split the key value pairs.

2

Hi,

In your filter you could replace all those \\r\\n with spaces usin the gsub processor

gsub => ["log","\\\r\\\n"," "]

kv { 
source => "log"
value_split => ":"
}
3

Thank you @grumo35. That worked perfectly.