Logstash kv filter issue with blank values

问题:

I am using the kv filter in my logstash configuration and I have a string that looks something like this:

key1="value1" key2="" key3= key4=1

Notice that key3 has no value; that causes key3 to be assigned a value of "key4=1" how do I fix this?

回答1:

It might not be the best solution, since we're blindly replacing:

  mutate {
    gsub => [
       "message", "= ", '="" '
    ]
  }

With this filter before the kv filter, any empty space after an equal sign are replaced with two quotes, giving this result:

"key1": "value1",
"key2": "\"\"",
"key3": "\"\"",
"key4": "1\r"