# K=V extractor help
**URL:** https://community.graylog.org/t/k-v-extractor-help/20933
**Category:** Graylog Central (peer support)
**Tags:** pipeline-rules
**Created:** [August 18, 2021, 9:17am UTC](https://community.graylog.org/t/k-v-extractor-help/20933 "2021-08-18T09:17:18Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@syntax](https://community.graylog.org/u/syntax)
#### Post date: [August 18, 2021, 9:17am UTC](https://community.graylog.org/t/k-v-extractor-help/20933/1 "2021-08-18T09:17:18Z")
I’m trying to use pipeline rules to dynamically extract the key/pair values.
I took reference from here,
> **[Key Value Parser Delivers Useful Information Fast | Graylog](https://www.graylog.org/post/key-value-parser)**
My log looks something like this,
`2021-04-19 10:45:34 Message details here, key1: value1, key2: value2`
`2021-04-19 10:45:34 ## Another format of message details here, key1: value1, key2: value2`
Here is what I’m trying to do…
**my issue is extracting the `timestamp` and the `message details`.**
```auto
rule "key_value_parser"
when
has_field("message")
then
set_fields(key_value(
value: to_string($message.message),
delimiters: ",",
kv_delimiters: ":",
trim_value_chars: "",
trim_key_chars:"",
));
end
```
by the way, how does `$message.message` come about?
---
### Author:  [@shoothub](https://community.graylog.org/u/shoothub)
#### Post date: [August 18, 2021, 9:32am UTC](https://community.graylog.org/t/k-v-extractor-help/20933/2 "2021-08-18T09:32:22Z")
HI @syntax
1. Why you try to use delimeter `;` if your message uses `,` delimeter?
2. Best way would be first to extract KV part from message using regex or GROK. Please post some real word examples so we can help.
---
### Author:  [@syntax](https://community.graylog.org/u/syntax)
#### Post date: [August 18, 2021, 1:19pm UTC](https://community.graylog.org/t/k-v-extractor-help/20933/3 "2021-08-18T13:19:35Z")
hi @shoothub,
1. thanks. fixed the error.
2. extractor runs before pipeline right? in that case, i can use grok pattern extractor followed by pipeline. does my logic sound right?
---
### Author:  [@shoothub](https://community.graylog.org/u/shoothub)
#### Post date: [August 18, 2021, 1:34pm UTC](https://community.graylog.org/t/k-v-extractor-help/20933/4 "2021-08-18T13:34:19Z")
1. Order of processing extractors and pipeline depends on configuration on `Message Processors Configuration` in `System - Configuration`. If using extractor, check if `Pipeline processor` is below `Message Filter Chain`, if you want to use extracted field in pipeline rules.
[https://docs.graylog.org/en/4.0/pages/pipelines/stream\_connections.html#the-importance-of-message-processor-ordering](https://docs.graylog.org/en/4.0/pages/pipelines/stream_connections.html#the-importance-of-message-processor-ordering)
Also note, that you can use `grok()` pipeline function in same (or new) pipeline rule as `key_value` pipeline function is you want, it’s not necessary to use extractor at all. It depends on what do you prefer.
[https://docs.graylog.org/en/4.0/pages/pipelines/functions.html#grok](https://docs.graylog.org/en/4.0/pages/pipelines/functions.html#grok)
---
### Author:  [@syntax](https://community.graylog.org/u/syntax)
#### Post date: [August 18, 2021, 1:54pm UTC](https://community.graylog.org/t/k-v-extractor-help/20933/5 "2021-08-18T13:54:09Z")
thank you for the reference links.
i know how to do it now.
---
### Author:  [@system](https://community.graylog.org/u/system)
#### Post date: [September 1, 2021, 1:54pm UTC](https://community.graylog.org/t/k-v-extractor-help/20933/6 "2021-09-01T13:54:38Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.