Using KV processors when field names have space

[BkQc]

Hello,
I'm trying to parse a log in which elements are separated by ; and keys/values by =.
My problem is that some keys have spaces in their name.
Though KV will process it correctly, having spaces in name causes lot of problem in the end (for query and grok multisourcing for instance).

What I would like is to replace the space in the name with _ or - but I can't find anything in the documentation.

A row of data coule look something like

MVC Controller=Home;MVC Action=Index

The keys are variable.

The end problem is related to this other post in which @Joe_Flemming, elastic team member, says they didn't think space in names were even possible.

Any suggestion even if OOB would be appreciated.

[spinscale (Alexander Reelsen)]

How about this (assuming you are using an ingest pipeline, which you did not specifically mention).

POST _ingest/pipeline/_simulate
{
  "pipeline": {
    "processors": [
      {
        "kv": {
          "field": "input",
          "target_field": "output",
          "field_split": ";",
          "value_split": "="
        }
      },
      {
        "script": {
          "lang": "painless",
          "source": "def data = ctx.output ; ctx.output = [:] ; data.forEach((k, v) -> ctx.output[k.replace(' ', '_')] = v);"
        }
      }
    ]
  },
  "docs": [
    {
      "_source": {
        "input": "MVC Controller=Home;MVC Action=Index"
      }
    }
  ]
}