RFE: Allow KV Filter value_split to be a regex or contain multiple grouped characters

Description

When using the KV filter, I have some data that is separated by the common => separator. If I try to specify that, it is interpreted as both = AND > on their own. This is especially problematic as the data may contain those characters individually elsewhere in the contents. This leads to bogus field names. It would be beneficial to either make this a regex (like the other args) or at least allow grouping of characters. == May be another common example.

Thanks,

-Chris

Activity

Show:
Former user
May 20, 2014, 6:01 PM

The main issue for me is that a free comment in a log has a high chance of hitting the separator. For instance, using ":" as a value separator someone enters "unit type APT from legalDescription: NCB" and now you have a ES mapping of "unit type APT from legalDescription" and your message field makes no sense. Opposed to being able to define your separator as '":"' which is much harder to hit as a false positive.

Assignee

Logstash Developers

Reporter

Chris Laplante
Configure