Link Search Menu Expand Document Documentation Menu
Documentation

This documentation describes using the kv processor in OpenSearch ingest pipelines. Consider using the Data Prepper key_value processor, which runs outside the OpenSearch cluster, if your use case involves large or complex datasets.

KV processor

The kv processor automatically extracts specific event fields or messages that are in a key=value format. This structured format organizes your data by grouping it together based on keys and values. It’s helpful for analyzing, visualizing, and using data, such as user behavior analytics, performance optimizations, or security investigations.

The kv processor creates a field for each key that it extracts, so the keys in your data determine the field names in your index. If the keys vary widely, the number of fields in the mapping can grow quickly. To store all extracted keys in a single field, set target_field and map that field as a flat_object.

Example

The following is the syntax for the kv processor:

{
  "kv": {
    "field": "message",
    "field_split": " ",
    "value_split": "="
  }
}

Configuration parameters

The following table lists the required and optional parameters for the kv processor.

Parameter Required/Optional Description
field Required The name of the field containing the data to be parsed. Supports template snippets.
field_split Required The regex pattern for key-value pair splitting.
value_split Required The regex pattern for splitting the key from the value within a key-value pair, for example, equal sign = or colon :.
exclude_keys Optional A list of keys to exclude from the document. Default is null.
include_keys Optional A list of keys to extract. Other keys are ignored. Default is to include all keys.
prefix Optional The prefix to add to the extracted keys. Default is null.
strip_brackets Optional If set to true, strips brackets ((), <>, or []) and quotes (' or ") from extracted values. Default is false.
trim_key Optional The string of characters to trim from the extracted keys.
trim_value Optional The string of characters to trim from the extracted values.
description Optional A brief description of the processor.
if Optional A condition for running the processor.
ignore_failure Optional If set to true, failures are ignored. Default is false.
on_failure Optional A list of processors to run if the processor fails.
ignore_missing Optional Specifies whether the processor should ignore documents that do not contain the specified field or in which the field is null. Default is false.
tag Optional An identifier tag for the processor. Useful for debugging in order to distinguish between processors of the same type. For more information, see Using processor tags for monitoring and debugging.
target_field Optional The name of the field in which to insert the extracted keys. If not specified, the keys are added to the root of the document. Supports template snippets.

Using the processor

Follow these steps to use the processor in a pipeline.

Step 1: Create a pipeline

The following query creates a pipeline, named kv-pipeline, that uses the kv processor to extract the message field of a document:

PUT _ingest/pipeline/kv-pipeline
{
  "description" : "Pipeline that extracts user profile data",
  "processors" : [
    {
      "kv" : {
        "field" : "message",
        "field_split": " ",
        "value_split": "="
      }
    }
  ]
}

Step 2 (Optional): Test the pipeline

It is recommended that you test your pipeline before you ingest documents.

To test the pipeline, run the following query:

POST _ingest/pipeline/kv-pipeline/_simulate
{  
  "docs": [  
    {  
      "_index": "testindex1",  
      "_id": "1",  
      "_source":{  
         "message": "goodbye=everybody hello=world"  
      }  
    }  
  ]  
}

Response

The following example response confirms that, in addition to the original message field, the document contains fields generated from key-value pairs:

{  
  "docs": [  
    {  
      "doc": {  
        "_index": "testindex1",  
        "_id": "1",  
        "_source": {  
          "hello": "world",  
          "message": "goodbye=everybody hello=world",  
          "goodbye": "everybody"  
        },  
        "_ingest": {  
          "timestamp": "2023-12-06T09:59:21.823292Z"  
        }  
      }  
    }  
  ]  
}

Step 3: Ingest a document

The following query ingests a document into an index named testindex1:

PUT testindex1/_doc/1?pipeline=kv-pipeline
{  
  "message": "goodbye=everybody hello=world"  
}

Step 4 (Optional): Retrieve the document

To retrieve the document, run the following query:

GET testindex1/_doc/1

350 characters left

Have a question? .

Want to contribute? or .