This processor helps automatically parse messages (or specific event fields) which are of the foo=bar variety.
For example, if you have a log message which contains ip=1.2.3.4 error=REFUSED
, you can parse those automatically by configuring:
{ "kv": { "field": "message", "field_split": " ", "value_split": "=" } }
Table 49. Kv Options
Name | Required | Default | Description |
---|---|---|---|
| yes | - | The field to be parsed |
| yes | - | Regex pattern to use for splitting key-value pairs |
| yes | - | Regex pattern to use for splitting the key from the value within a key-value pair |
| no |
| The field to insert the extracted keys into. Defaults to the root of the document |
| no |
| List of keys to filter and insert into document. Defaults to including all keys |
| no |
| List of keys to exclude from document |
| no |
| If |
| no |
| Prefix to be added to extracted keys |
| no |
| String of characters to trim from extracted keys |
| no |
| String of characters to trim from extracted values |
| no |
| If |
| no | - | Conditionally execute this processor. |
| no | - | Handle failures for this processor. See Handling Failures in Pipelines. |
| no |
| Ignore failures for this processor. See Handling Failures in Pipelines. |
| no | - | An identifier for this processor. Useful for debugging and metrics. |