Link Search Menu Expand Document Documentation Menu

key_value

Overview

Takes in a field and parses it into key/value pairs.

Option Required Type Description
source No String The key in the event that is parsed. Default value is message.
destination No String The key where to output the parsed source to. Doing this overwrites the value of the key if it exists. Default value is parsed_message
field_delimiter_regex Conditionally String A regex specifying the delimiter between key/value pairs. Special regex characters such as [ and ] must be escaped using \\. This option cannot be defined at the same time as field_split_characters.
field_split_characters Conditionally String A string of characters to split between key/value pairs. Special regex characters such as [ and ] must be escaped using \\. Default value is &. This option cannot be defined at the same time as field_delimiter_regex.
key_value_delimiter_regex Conditionally String A regex specifying the delimiter between a key and a value. Special regex characters such as [ and ] must be escaped using \\. There is no default value. This option cannot be defined at the same time as value_split_characters.
value_split_characters Conditionally String A string of characters to split between keys and values. Special regex characters such as [ and ] must be escaped using \\. Default value is =. This option cannot be defined at the same time as key_value_delimiter_regex.
non_match_value No String When a key/value cannot be successfully split, the key/value is be placed in the key field and the specified value in the value field. Default value is null.
prefix No String A prefix given to all keys. Default value is empty string.
delete_key_regex No String A regex used to delete characters from the key. Special regex characters such as [ and ] must be escaped using \\. There is no default value.
delete_value_regex No String A regex used to delete characters from the value. Special regex characters such as [ and ] must be escaped using \\. There is no default value.

See a problem? Submit or on GitHub.