I have a wineventlog-application log which has (ie) 'EventCode=33210 EventRecordID=12345' then changes to session_id:69,server_principal_id:226,etc etc so from = to : with , instead of spaces. Is there a way I can use the one Key-value processor to handle both?

Using Key-value(KV) with multiple Value splits

Rios (Rios) November 6, 2023, 3:03pm 2

Can you show a message not just few fields?

Topic		Replies	Views
Logstash kv field split problem Logstash	8	829	January 24, 2021
How to handle '=' in values, splitting on \| but KV takes over all '=' not only the first Logstash	3	867	September 22, 2017
Key value pair Logstash	2	1789	February 4, 2019
Kv filter plugin when there are spaces in key and value Logstash	5	8994	July 6, 2017
KV filter problem with value_split Logstash	2	337	June 25, 2018

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Using Key-value(KV) with multiple Value splits

Related topics