According to @whack
With the following config:
The following message:
Should create the following output:
But instead creates the following output:
Was part of the conversation on IRC about this - This is totally a bug.
The code itself looks for quoted strings by doing "
+" which captures anything up to the first double quote. It should be more like the QUOTEDSTRING pattern grok ships with.
Now tracked at https://github.com/logstash-plugins/logstash-filter-kv/issues/2
Discussion moved to https://github.com/logstash-plugins/logstash-filter-kv/issues/2