# Extract colon-separated key-value pairs

**URL:** <https://community.graylog.org/t/extract-colon-separated-key-value-pairs/19381>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules\
**Created:** [April 7, 2021, 10:39am UTC](https://community.graylog.org/t/extract-colon-separated-key-value-pairs/19381 "2021-04-07T10:39:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![elisi84](https://avatars.discourse-cdn.com/v4/letter/e/50afbb/32.png) [@elisi84](https://community.graylog.org/u/elisi84)\
**Post date:** [April 7, 2021, 10:39am UTC](https://community.graylog.org/t/extract-colon-separated-key-value-pairs/19381/1 "2021-04-07T10:39:18Z")

</div>

Hello,  
I am trying to extract colon-separated key-value pairs, but the result is not as expected.

Raw message :  
\<38\>Apr 07 10:28:05 ISCSI-YYYXXXX qlogd[6421]: conn log: Users: fake\_user, Source IP: 123.456.789.12, Computer name: —, Connection type: HTTP, Accessed resources: Administration, Action: Login OK

Rule:  
rule “key\_value\_parser”  
when  
contains(to\_string($message.message), “ISCSI-NASCNET1”)  
then  
set\_fields(  
fields:  
key\_value(  
value: to\_string($message.message),  
delimiters:",",  
kv\_delimiters:":"  
)  
);

end

The result is that only one field is created, and it is the field Action with value Logout.  
Any suggestion?  
Thanks,  
Emanuele.

---

<div class="post-metadata">

**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\
**Post date:** [April 7, 2021, 2:05pm UTC](https://community.graylog.org/t/extract-colon-separated-key-value-pairs/19381/2 "2021-04-07T14:05:37Z")

</div>

I don’t think, that KV is a right tool. I would suggest to use grok patterns like this:

- conn log:  
`Users: %{DATA:NAS_user}, Source IP: %{IP:NAS_IP}, Computer name: %{DATA:NAS_id}, Connection type: %{DATA:NAS_connection}, Accessed resources: %{DATA:NAS_resource}, Action: %{GREEDYDATA:NAS_action}`

- event log:  
`Users: %{DATA:NAS_user}, Source IP: %{IP:NAS_IP}, Computer name: %{DATA:NAS_id}, Content: %{GREEDYDATA:NAS_action}`  
`Users: %{DATA:NAS_user}, Source IP: %{IP:NAS_IP}, Computer name: %{DATA:NAS_id}, Application: %{DATA:NAS_application}, Category: %{DATA:NAS_category}, Content: %{GREEDYDATA:NAS_action}`

Instead of pipeline rule, you can use grok extractors as well.

---

<div class="post-metadata">

**Author:** ![elisi84](https://avatars.discourse-cdn.com/v4/letter/e/50afbb/32.png) [@elisi84](https://community.graylog.org/u/elisi84)\
**Post date:** [April 8, 2021, 9:16am UTC](https://community.graylog.org/t/extract-colon-separated-key-value-pairs/19381/3 "2021-04-08T09:16:37Z")

</div>

Many thanks @shoothub , at the moment I have found another solution to my problem and I do not need the extraction anymore, but I have really appreciated your answer. Maybe I will use it in the future. Thanks,  
Emanuele.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [April 22, 2021, 9:17am UTC](https://community.graylog.org/t/extract-colon-separated-key-value-pairs/19381/4 "2021-04-22T09:17:04Z")

</div>

Closed on April 22, 2021, 9:17am UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.