KV processor
editKV processor
editThis processor helps automatically parse messages (or specific event fields) which are of the foo=bar
variety.
For example, if you have a log message which contains ip=1.2.3.4 error=REFUSED
, you can parse those fields automatically by configuring:
{ "kv": { "field": "message", "field_split": " ", "value_split": "=" } }
Using the KV Processor can result in field names that you cannot control. Consider using the Flattened data type instead, which maps an entire object as a single field and allows for simple searches over its contents.
Table 26. KV Options
Name | Required | Default | Description |
---|---|---|---|
|
yes |
- |
The field to be parsed |
|
yes |
- |
Regex pattern to use for splitting key-value pairs |
|
yes |
- |
Regex pattern to use for splitting the key from the value within a key-value pair |
|
no |
|
The field to insert the extracted keys into. Defaults to the root of the document |
|
no |
|
List of keys to filter and insert into document. Defaults to including all keys |
|
no |
|
List of keys to exclude from document |
|
no |
|
If |
|
no |
|
Prefix to be added to extracted keys |
|
no |
|
String of characters to trim from extracted keys |
|
no |
|
String of characters to trim from extracted values |
|
no |
|
If |
|
no |
- |
Conditionally execute this processor. |
|
no |
- |
Handle failures for this processor. See Handling Failures in Pipelines. |
|
no |
|
Ignore failures for this processor. See Handling Failures in Pipelines. |
|
no |
- |
An identifier for this processor. Useful for debugging and metrics. |