# Value split is ":"
**URL:** https://discuss.elastic.co/t/value-split-is/99123
**Category:** Logstash
**Created:** [September 1, 2017, 12:05pm UTC](https://discuss.elastic.co/t/value-split-is/99123 "2017-09-01T12:05:54Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@ssasporta](https://discuss.elastic.co/u/ssasporta)
#### Post date: [September 1, 2017, 12:05pm UTC](https://discuss.elastic.co/t/value-split-is/99123/1 "2017-09-01T12:05:54Z")
Hi,
**I have kv text with the value split ":". In the text I also have some ":".**
For example : (after the https.)
`Refferer(URI):https://wifiondemand.xfinity.com/wod/selfservice/?lang=en&ui_style=light`
My filter looks like that:
```
if [clientInfo] =~ /.+/ {
kv {
value_split => ":"
field_split => "::"
source => "clientInfo"
}
}
```
The output result is :
```
` " R\nefferer(URI)" => "https",`
```
How can I handle it?
Regards,
Sharon.
---
### Author:  [@paz](https://discuss.elastic.co/u/paz)
#### Post date: [September 1, 2017, 12:35pm UTC](https://discuss.elastic.co/t/value-split-is/99123/2 "2017-09-01T12:35:05Z")
A quick solution would be using gsub (either by mutate filter or ruby filter) on the original message to replace the _https:_ part prior to using KV with something that won't mess with it, like it's encoded value (_https%3A_) in order to avoid jumping through hoops to deal with it inside the KV filter.
---
### Author:  [@ssasporta](https://discuss.elastic.co/u/ssasporta)
#### Post date: [September 4, 2017, 9:09am UTC](https://discuss.elastic.co/t/value-split-is/99123/3 "2017-09-04T09:09:21Z")
great.
I used mutate and it worked.
```
if [clientInfo] =~ /.+/ {
mutate {
gsub => [
# replace in clientInfo the 'https:'
"clientInfo", "https:", "https%3A"
]
```
My current problem is that I also have Timestamp in the clientInfo.
```
"clientInfo" => "User-Agent:Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_2 like Mac OS X) AppleWebKit/603.2.4 (KHTML, like Gecko) Version/10.0 Mobile/14F89 Safari/602.1 :: Refferer(URI):https%3A//wifiondemand.xfinity.com/wod/selfservice/?lang=en&ui_style=light :: Client IP:172.58.56.216, 10.10.10.159, 10.108.2.44 ::Timestamp:2017-07-27 13:34:06.329"
```
the kvstring command break it wrongly too:
"Timestamp" =\> "2017-07-27 13",
"34" =\> "06.329",
Thanks
Sharon.
---
### Author:  [@ssasporta](https://discuss.elastic.co/u/ssasporta)
#### Post date: [September 5, 2017, 11:28am UTC](https://discuss.elastic.co/t/value-split-is/99123/4 "2017-09-05T11:28:18Z")
To Solve it, I wrote a ruby code, but it doesn't work in the logstash.
(It is running successfully on ruby!)
The clientInfo :
```
"clientInfo" => "User-Agent:Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_2 like Mac OS X) AppleWebKit/603.2.4 (KHTML, like Gecko) Version/10.0 Mobile/14F89 Safari/602.1 :: Refferer(URI):https%3A//wifiondemand.xfinity.com/wod/selfservice/?lang=en&ui_style=light :: Client IP:172.58.56.216, 10.10.10.159, 10.108.2.44 :: Timestamp:2017-07-27 13:34:06.329"
```
This is the ruby filter:
```
ruby {
# Substitute the ":" in the TimeStamp to encoded value.
init => "clientinfostring = event['clientInfo']"
code => " startpoint=@clientinfostring.index("Timestamp")
newstring=@clientinfostring[startpoint+21,8]
updatedstring=newstring.gsub!(":","%3A")
event['clientInfo']=updatedstring"
}
```
Any idea?
Thanks
Sharon.
---
### Author:  [@jattilioz](https://discuss.elastic.co/u/jattilioz)
#### Post date: [September 7, 2017, 1:32am UTC](https://discuss.elastic.co/t/value-split-is/99123/5 "2017-09-07T01:32:13Z")
What if you used a Grok filter before the KV filter to pull out the time stamp? Then use include\_keys for the KV to only keep what you want from the event, which will not include the "Timestamp" or "34" in the KV filter.
Timestamp:%{TIMESTAMP\_ISO8601}
[https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/)
---
### Author:  [@paz](https://discuss.elastic.co/u/paz)
#### Post date: [September 11, 2017, 7:18am UTC](https://discuss.elastic.co/t/value-split-is/99123/6 "2017-09-11T07:18:19Z")
What exactly is the issue with this Ruby code? It doesn't produce the expected results?
Also, why are you defining the _clientinfostring_ on the init block? If I recall correctly, this block is ran only once (on start) so this variable never gets updated with each following event's value. Try moving it inside the actual code block.
---
### Author:  [@ssasporta](https://discuss.elastic.co/u/ssasporta)
#### Post date: [September 11, 2017, 12:58pm UTC](https://discuss.elastic.co/t/value-split-is/99123/7 "2017-09-11T12:58:26Z")
It actually doesn't produce nothing from the Logstash.
I will try to move it into the code block.
Thanks
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 9, 2017, 12:58pm UTC](https://discuss.elastic.co/t/value-split-is/99123/8 "2017-10-09T12:58:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.