# Pipeline whitespace issues

**URL:** <https://community.graylog.org/t/pipeline-whitespace-issues/17586>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules, route-to-streampl\
**Created:** [October 21, 2020, 3:14pm UTC](https://community.graylog.org/t/pipeline-whitespace-issues/17586 "2020-10-21T15:14:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![MAMAOUI](https://avatars.discourse-cdn.com/v4/letter/m/e79b87/32.png) [@MAMAOUI](https://community.graylog.org/u/MAMAOUI)\
**Post date:** [October 21, 2020, 3:14pm UTC](https://community.graylog.org/t/pipeline-whitespace-issues/17586/1 "2020-10-21T15:14:26Z")

</div>

Hi,

I have set up the following rule in a pipeline:

```
rule "Fortinet parsing"
when
    has_field("message")
then
    // extract all key-value from "message" and prefix it with kv_ 
    set_fields(
                fields: 
                        key_value(
                            value: to_string($message.message),
                            trim_value_chars: "\""
                            )
            );
    route_to_stream(id:"........", remove_from_default:true);
end

```

but when it comes to values that have whitespace they get cut off, like this:

 ![graylog](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/d/d64ed2471111548a0f8d66c7eee60580f8e3bac9.png)

I tried delimiter but its not working:

key\_value(  
value: to\_string($message.message),  
trim\_value\_chars: “”",  
trim\_key\_chars:""", delimiters:" “,  
kv\_delimiters:”=") );

How can I get it to ignore the whitespace if it’s part of a value?

Thank you

---

<div class="post-metadata">

**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\
**Post date:** [October 22, 2020, 8:51am UTC](https://community.graylog.org/t/pipeline-whitespace-issues/17586/2 "2020-10-22T08:51:03Z")

</div>

I think, it’s a known problem with key\_value pipeline function.

Try to use extractor key=value, it should work fine also with spaces:

> **[Extractors — Graylog 3.3.8 documentation](https://docs.graylog.org/en/3.3/pages/extractors.html#automatically-extract-all-key-value-pairs)**

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [November 5, 2020, 8:51am UTC](https://community.graylog.org/t/pipeline-whitespace-issues/17586/3 "2020-11-05T08:51:06Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.