Key-Value

Parse Data Analysis

Synopsis

Parses key=value formatted messages into structured fields.

Schema

- key_value:
    field: <ident>
    target_field: <string>
    field_split: <string>
    value_split: <string>
    include_keys: <array>
    exclude_keys: <array>
    prefix: <string>
    trim_key: <string>
    trim_value: <string>
    description: <text>
    if: <script>
    ignore_failure: <boolean>
    ignore_missing: <boolean>
    on_failure: <processor[]>
    on_success: <processor[]>
    tag: <string>

Configuration

The following fields are used to define the processor:

Field	Required	Default	Description
field	Y	-	Source field containing key=value formatted data
target_field	N	Root level	Target field to store parsed key-value pairs
field_split	N	\s+	Regex pattern to split fields (space by default)
value_split	N	=	Character(s) to split key from value
include_keys	N	-	Array of keys to include (whitelist)
exclude_keys	N	-	Array of keys to exclude (blacklist)
prefix	N	-	Prefix to add to all extracted field names
trim_key	N	"'	Characters to trim from keys
trim_value	N	"'	Characters to trim from values
description	N	-	Explanatory note
if	N	-	Condition to run
ignore_failure	N	false	Continue processing if parsing fails
ignore_missing	N	false	Skip processing if referenced field doesn't exist
on_failure	N	-	See Handling Failures
on_success	N	-	See Handling Success
tag	N	-	Identifier

Details

Parses structured data from key=value formatted strings commonly found in log messages, configuration data, and query parameters. The processor supports flexible field and value separators and can filter keys using include/exclude lists.

The processor automatically handles quoted values and provides options for trimming unwanted characters from keys and values.

note

The processor supports various key=value formats including space-separated ("key1=value1 key2=value2"), comma-separated, and custom delimited formats. The field_split parameter accepts regex patterns for complex splitting requirements.

When both include_keys and exclude_keys are specified, the include list takes precedence, and only explicitly included keys are processed.

warning

If the source field contains malformed key=value pairs or uses unexpected separators, some pairs may be skipped. Use ignore_failure to continue processing even when parsing encounters errors.

Examples

Basic Key-Value Parsing

Parsing space-separated key=value pairs...	{ "log_data": "user=john status=success duration=150ms" } - key_value: field: log_data
extracts fields to root level:	{ "log_data": "user=john status=success duration=150ms", "user": "john", "status": "success", "duration": "150ms" }

With Target Field

Storing parsed data in specific field...	{ "message": "action=login ip=192.168.1.100 result=success" } - key_value: field: message target_field: parsed_data
creates nested structure:	{ "message": "action=login ip=192.168.1.100 result=success", "parsed_data": { "action": "login", "ip": "192.168.1.100", "result": "success" } }

Custom Separators

Using comma separation and colon assignment...	{ "config_string": "host:localhost,port:8080,ssl:true" } - key_value: field: config_string field_split: "," value_split: ":" target_field: config
handles custom delimiters:	{ "config_string": "host:localhost,port:8080,ssl:true", "config": { "host": "localhost", "port": "8080", "ssl": "true" } }

Key Filtering

Including only specific keys...	{ "event_data": "user=alice action=delete file=doc.txt timestamp=1234567890" } - key_value: field: event_data include_keys: ["user", "action"] prefix: "event_"
extracts only specified keys:	{ "event_data": "user=alice action=delete file=doc.txt timestamp=1234567890", "event_user": "alice", "event_action": "delete" }

Quoted Values

Handling quoted values with spaces...	{ "query_string": "name=\"John Doe\" city=\"New York\" age=30" } - key_value: field: query_string trim_value: '"' target_field: query_params
removes quotes from values:	{ "query_string": "name=\"John Doe\" city=\"New York\" age=30", "query_params": { "name": "John Doe", "city": "New York", "age": "30" } }