can escape the first element split by the kv filter ???

[reesechou2014]

For all general issues, please provide the following details for fast resolution:

• Version: logstash 7.1.1 with kv filter

• Operating System: centos7.2

• Config File :

  filter {
  kv {
   field_split_pattern => "\|{3}"
   value_split => ":"
  }
  }

• Sample Data: 2019-11-27 15:54 xxxxx ||| a: 1 ||| b:2

• result

  message => 2019-11-27 15:54 xxxxx ||| a: 1 ||| b:2
  2019-11-27 15 => :54 xxxxx ||| a: 1 ||| b:2
  a => 1
  b=> 2

i do not need the key '2019-11-27 15' , how can i do to exclude this ?

[andsel]

Perhaps you could use the prune filter to remove the undesired field, if you have a common pattern for the first key-value element that you want to drop

[reesechou2014]

OK, thanks, I have avoided this by using other special characters like ':=' in value_split