NOTE: You are looking at documentation for an older release. For the latest information, see the current release documentation.
KV Processor
editKV Processor
editThis processor helps automatically parse messages (or specific event fields) which are of the foo=bar variety.
For example, if you have a log message which contains ip=1.2.3.4 error=REFUSED
, you can parse those automatically by configuring:
{ "kv": { "field": "message", "field_split": " ", "value_split": "=" } }
Table 46. Kv Options
Name | Required | Default | Description |
---|---|---|---|
|
yes |
- |
The field to be parsed |
|
yes |
- |
Regex pattern to use for splitting key-value pairs |
|
yes |
- |
Regex pattern to use for splitting the key from the value within a key-value pair |
|
no |
|
The field to insert the extracted keys into. Defaults to the root of the document |
|
no |
|
List of keys to filter and insert into document. Defaults to including all keys |
|
no |
|
List of keys to exclude from document |
|
no |
|
If |
|
no |
|
Prefix to be added to extracted keys |
|
no |
|
String of characters to trim from extracted keys |
|
no |
|
String of characters to trim from extracted values |
|
no |
|
If |
|
no |
- |
Conditionally execute this processor. |
|
no |
- |
Handle failures for this processor. See Handling Failures in Pipelines. |
|
no |
|
Ignore failures for this processor. See Handling Failures in Pipelines. |
|
no |
- |
An identifier for this processor. Useful for debugging and metrics. |