# Using KV with JSON

**URL:** <https://discuss.elastic.co/t/using-kv-with-json/27907>\
**Category:** Logstash\
**Created:** [August 23, 2015, 5:48pm UTC](https://discuss.elastic.co/t/using-kv-with-json/27907 "2015-08-23T17:48:56Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![coderlol](https://avatars.discourse-cdn.com/v4/letter/c/da6949/32.png) [@coderlol](https://discuss.elastic.co/u/coderlol)\
**Post date:** [August 23, 2015, 5:48pm UTC](https://discuss.elastic.co/t/using-kv-with-json/27907/1 "2015-08-23T17:48:56Z")

</div>

My app generates the log entries in the following format. Logstash Forwarder ships the logs to Logstash Indexer which in turn pushes the logs into Elasticsearch. I'm using LSF 0.4.0, Logstash 1.5.3, ES 1.7.1

{"@version":"1","@timestamp":"2015-08-23T17:37:33.235Z","thread":"098658","level":"INFO","marker":{"name":"LOGGABLE"},"message":"someId=PMCtuW9.6sKDC,someMoreId=blabla"}

filter {  
if [type] == "myapp" {  
json {  
source =\> "message"  
kv {  
source =\> "myapp.%{[message]}"  
}  
}  
}

I was looking to get the fields someId and someMoreIds indexed and searchable, and such. However, I have not been successful yet. I am thinking that my field referencing is incorrect.

I've tried kv with source =\> "message", source =\> "[message][message]" without success

The json portion works fine.

Thx

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 23, 2015, 6:03pm UTC](https://discuss.elastic.co/t/using-kv-with-json/27907/2 "2015-08-23T18:03:30Z")

</div>

`source => "message"` is what you should use. While I don't think it's causing your problems, you also need to set `field_split => ","` since your key/value pairs aren't separated by spaces.

---

<div class="post-metadata">

**Author:** ![coderlol](https://avatars.discourse-cdn.com/v4/letter/c/da6949/32.png) [@coderlol](https://discuss.elastic.co/u/coderlol)\
**Post date:** [August 23, 2015, 6:32pm UTC](https://discuss.elastic.co/t/using-kv-with-json/27907/3 "2015-08-23T18:32:19Z")

</div>

That works. I am getting the good stuff now, maybe too much, but that's a different story. Thx

---

<div class="post-metadata">

**Author:** ![coderlol](https://avatars.discourse-cdn.com/v4/letter/c/da6949/32.png) [@coderlol](https://discuss.elastic.co/u/coderlol)\
**Post date:** [August 23, 2015, 6:34pm UTC](https://discuss.elastic.co/t/using-kv-with-json/27907/4 "2015-08-23T18:34:03Z")

</div>

As a reference in case it helps someone else, I changed to source =\> "message" and added the field\_split =\> ","

---

<div class="post-metadata">

**Author:** ![coderlol](https://avatars.discourse-cdn.com/v4/letter/c/da6949/32.png) [@coderlol](https://discuss.elastic.co/u/coderlol)\
**Post date:** [August 23, 2015, 6:39pm UTC](https://discuss.elastic.co/t/using-kv-with-json/27907/5 "2015-08-23T18:39:41Z")

</div>

Btw, the json filter is referencing "message" and that means the log entry?

{"@version":"1","@timestamp":"2015-08-23T17:37:33.235Z","thread":"098658","level":"INFO","marker":{"name":"LOGGABLE"},"message":"someId=PMCtuW9.6sKDC,someMoreId=blabla"}

or does "message" refers to the field "message" within the log entry?

Similarly, for the kv filter, does "message" refer to the log entry or the field message with in the log entry?

Thanks...

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 23, 2015, 7:18pm UTC](https://discuss.elastic.co/t/using-kv-with-json/27907/6 "2015-08-23T19:18:10Z")

</div>

There is no concept for referring to the whole log entry, so `message` refers to the message field in both cases.

---

<div class="post-metadata">

**Author:** ![coderlol](https://avatars.discourse-cdn.com/v4/letter/c/da6949/32.png) [@coderlol](https://discuss.elastic.co/u/coderlol)\
**Post date:** [August 23, 2015, 10:11pm UTC](https://discuss.elastic.co/t/using-kv-with-json/27907/7 "2015-08-23T22:11:12Z")

</div>

Well, my message field is "message":"someId=PMCtuW9.6sKDC,someMoreId=blabla"

So, I figure your reference "message" is probably my log entry below? That's what in my log. It gets stuffed in a logstash "message" field, I guess.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:31am UTC](https://discuss.elastic.co/t/using-kv-with-json/27907/8 "2017-07-06T05:31:12Z")

</div>