values having XML documents break unexpected making not valid keys

[purbon]

With the introduction of 73af4317e50498e6f0bd318ea704966dce1ee946 a message like:

foo=bar|time=zero|payload=<?xml version=\"1.0\" encoding=\"UTF-8\"?> <S:Envelope xmlns:xs=\"http://www.w3.org/2001/XMLSchema\">

is break into KV pairs like

 foo="bar"
time="zero"
payload ="<?xml version=\"1.0\" encoding=\"UTF-8\"?> "
<S:Envelopexmlns:xs=...

obviously <S:Envelopexmlns:xs is not expected as key, and should be part of the payload, but the new regexp feature introduced it things is a new thing to break is pairs.

[jordansissel]

This seems odd. The kv filter configured to split pairs on | and kv on = should work. It doesn't? The payload here should be <?xml version=\"1.0\" encoding=\"UTF-8\"?> <S:Envelope xmlns:xs=\"http://www.w3.org/2001/XMLSchema\">

[colinsurprenant]

it works.

bin/logstash -e 'filter{kv{field_split => "|" value_split => "="}} '

foo=bar|time=zero|payload=<?xml version=\"1.0\" encoding=\"UTF-8\"?> <S:Envelope xmlns:xs=\"http://www.w3.org/2001/XMLSchema\">

{
          "time" => "zero",
      "@version" => "1",
    "@timestamp" => 2019-08-05T22:08:47.415Z,
          "type" => "stdin",
          "host" => "mbp15r.local",
       "payload" => "<?xml version=\\\"1.0\\\" encoding=\\\"UTF-8\\\"?> <S:Envelope xmlns:xs=\\\"http://www.w3.org/2001/XMLSchema\\\">",
       "message" => "foo=bar|time=zero|payload=<?xml version=\\\"1.0\\\" encoding=\\\"UTF-8\\\"?> <S:Envelope xmlns:xs=\\\"http://www.w3.org/2001/XMLSchema\\\">",
           "foo" => "bar"
}

Closing.