# Key\_value - remove space in field portion

**URL:** <https://community.graylog.org/t/key-value-remove-space-in-field-portion/13398>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules\
**Created:** [January 8, 2020, 8:28pm UTC](https://community.graylog.org/t/key-value-remove-space-in-field-portion/13398 "2020-01-08T20:28:43Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\
**Post date:** [January 8, 2020, 8:28pm UTC](https://community.graylog.org/t/key-value-remove-space-in-field-portion/13398/1 "2020-01-08T20:28:43Z")

</div>

I have a key\_value result but the fields portion have spaces that I need to convert to underscore to use the set\_fields() function. I can use regex\_replace -but- the regex I have matches on spaces in the key **and** value portion. So for instance:

`client os version=microsoft windows 10 pro 64-bit`

becomes

`client_os_version=microsoft_windows_10_pro_64-bit`

when what I want is:

`client_os_version=microsoft windows 10 pro 64-bit`

The usable but not optimal regex with example data ([https://regex101.com/r/W3kxCd/1](https://regex101.com/r/W3kxCd/1))

`(?=\b\s+)\s`

`{user name=b.oaks, config name=corp-epointsetting, private ip=10.42.7.207, client region=us, client ip=75.75.58.65, client version=5.0.0-87, device name=zz-777, client os version=microsoft windows 10 pro 64-bit, vpn type=device level vpn}`  
.  
I could grok it (as I erroneously suggested on an earlier post by someone else with a similar quest) but then I would have to create one for each possible key\_value that comes in… bleh.

What would **you** do?

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [January 9, 2020, 6:12am UTC](https://community.graylog.org/t/key-value-remove-space-in-field-portion/13398/2 "2020-01-09T06:12:06Z")

</div>

he @tmacgbay

for the long run I would add a feature request - to have the option in Key-Value function to replace not allowed characters in key.

> **[Graylog2/graylog2-server](https://github.com/Graylog2/graylog2-server/issues)**
>
> Free and open source log management. Contribute to Graylog2/graylog2-server development by creating an account on GitHub.

---

<div class="post-metadata">

**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\
**Post date:** [January 9, 2020, 4:53pm UTC](https://community.graylog.org/t/key-value-remove-space-in-field-portion/13398/3 "2020-01-09T16:53:15Z")

</div>

Would make more sense to have special characters handled in `set_fields()` and `set_field()`? - that way it would also catch any other data coming through from grok (etc.) would be massaged appropriately.

key\_value() still works with the spaces, it’s when you are creating the fields that it chokes.

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [January 10, 2020, 7:09am UTC](https://community.graylog.org/t/key-value-remove-space-in-field-portion/13398/4 "2020-01-10T07:09:23Z")

</div>

thx for the issue:

> <https://github.com/Graylog2/graylog2-server/issues/7137>
>
> Issue to be solved
> Data processed by pipeline rule function key\_value() might contain spaces in the key portion. This makes the key...

and you are right about the idea you have!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [January 24, 2020, 7:17am UTC](https://community.graylog.org/t/key-value-remove-space-in-field-portion/13398/5 "2020-01-24T07:17:54Z")

</div>

Closed on January 24, 2020, 7:17am UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.