# What filter i need?
**URL:** https://discuss.elastic.co/t/what-filter-i-need/176954
**Category:** Logstash
**Created:** [April 15, 2019, 6:29pm UTC](https://discuss.elastic.co/t/what-filter-i-need/176954 "2019-04-15T18:29:52Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@OlegInishev](https://discuss.elastic.co/u/OlegInishev)
#### Post date: [April 15, 2019, 6:29pm UTC](https://discuss.elastic.co/t/what-filter-i-need/176954/1 "2019-04-15T18:29:52Z")
Hi evryone! I have next log example
[time\_field] key1=val1 key2=val2 key3=val3 ACTION\_TYPE key4=val4 key5=val5
I want cut ACTION\_TYPE from message and add him in new field, and then use KV-filter for key-value.
I use KV because keys sometimes change position.
How i can do this?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 15, 2019, 7:22pm UTC](https://discuss.elastic.co/t/what-filter-i-need/176954/2 "2019-04-15T19:22:30Z")
You need to provide more information. If the time field is always surrounded by square brackets it is easy to dissect that out and then mutate+gsub it away.
What identifies ACTION\_TYPE? Is it always the fourth field after the [time\_field]. We need to know how to find it.
Are the values in the key value pairs ever blank?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 13, 2019, 7:22pm UTC](https://discuss.elastic.co/t/what-filter-i-need/176954/3 "2019-05-13T19:22:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.