Key Value [kv]

This processor allows you to extract fields from a string that is in a key=value format. You can specify different characters for the field split and value split to fit your log format.

• field
• targetField
• includeKeys - [array] (Required) - all the fields you need to extract.
• excludeKeys - [array] (optional)
• trim (optional) - removes key from the value
• trimKey (optional) - removed given key from the value
• valueSplit (optional - default is = )
• fieldSplit (optional - default is " ")
• allowDuplicateValues (optional = default false)
• prefix (optional)
• maxKeyLength integer (by default 40)

Example

{
  "steps": [
    {
      "kv": {
        "config": {
          "field": "message",
          "targetField": "params",
          "fieldSplit": " ",
          "valueSplit": ":",
          "trim": "//",
          "includeKeys":["timestamp","level","msg"]
        }
      }
    }
  ]
}