title: KV filter logstash value_split
body: <p>Hi i am using kv filter to split my string I wanted to know how do I put the values after I split em. For example: </p>
  
  <p>My logs look like below:</p>
  
  <pre><code>47.30.221.46 - - [04/Sep/2017:13:24:44 +0530] "GET /api/v1.2/places/search/json?username=gaurav.saxena889&amp;location=28.5506382,77.2689024&amp;query=sunrise%20hy&amp;explain=true&amp;bridge=true HTTP/1.1" 200 2522 45402
  47.30.221.46 - - [04/Sep/2017:13:24:46 +0530] "GET /api/v1.2/places/search/json?username=gaurav.saxena889&amp;location=28.5506382,77.2689024&amp;query=hy&amp;explain=true&amp;bridge=true HTTP/1.1" 200 2169 55267
  47.30.221.46 - - [04/Sep/2017:13:24:47 +0530] "GET /api/v1.2/places/search/json?username=gaurav.saxena889&amp;location=28.5506382,77.2689024&amp;query=hyun&amp;explain=true&amp;bridge=true HTTP/1.1" 200 2530 29635
  47.30.221.46 - - [04/Sep/2017:13:24:47 +0530] "GET /api/v1.2/places/search/json?username=gaurav.saxena889&amp;location=28.5506382,77.2689024&amp;query=hyunda&amp;explain=true&amp;bridge=true HTTP/1.1" 200 2572 25449
  47.30.221.46 - - [04/Sep/2017:13:24:48 +0530] "GET /api/v1.2/places/search/json?username=gaurav.saxena889&amp;location=28.5506382,77.2689024&amp;query=hyundai&amp;explain=true&amp;bridge=true HTTP/1.1" 200 3576 28007
  47.30.221.46 - - [04/Sep/2017:13:24:58 +0530] "GET /api/v1.2/places/search/json?username=gaurav.saxena889&amp;location=28.5506382,77.2689024&amp;query=su&amp;explain=true&amp;bridge=true HTTP/1.1" 200 2354 96861
  47.30.221.46 - - [04/Sep/2017:13:24:58 +0530] "GET /api/v1.2/places/search/json?username=gaurav.saxena889&amp;location=28.5506382,77.2689024&amp;query=sun&amp;explain=true&amp;bridge=true HTTP/1.1" 200 3224 50897
  </code></pre>
  
  <p>My logstash config file looks like below:</p>
  
  <pre><code>input {
    beats {
      port =&gt; 5044
      client_inactivity_timeout =&gt; 86400
    }
  }
  
  filter {
      grok {
          match =&gt; {
              "message" =&gt; "%{IPORHOST:client_ip} %{HTTPDUSER:ident} %{HTTPDUSER:auth} \[%{HTTPDATE:timestamp}\] \"(?:%{WORD:method} /api/v%{NUMBER:version}/%{DATA:resource}/%{DATA:subresource}/%{DATA:response_type}\?%{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})\" %{NUMBER:response_code} (?:%{NUMBER:data_transfered}|-) %{NUMBER:response_time}"
          }
      }
      kv {
          source =&gt; "request"
          field_split =&gt; "&amp;"
      }
  
      if [query] {
          mutate {
              rename =&gt; { "query" =&gt; "searched_keword" }
          }
      } else if [keyword] {
          mutate {
              rename =&gt; { "keyword" =&gt; "searched_keyword" }
          }
      }
  
      if [refLocation] {
          mutate {
              rename =&gt; { "refLocation" =&gt; "location" }
          }
      }
  
      mutate {
          convert =&gt; { "response_code" =&gt; "integer" }
      }
  
      mutate {
          convert =&gt; { "data_transfered" =&gt; "integer" }
      }
  
      mutate {
          convert =&gt; { "version" =&gt; "float" }
      }
  
      mutate {
          convert =&gt; { "response_time" =&gt; "integer" }
      }
  
      if [location] {
          kv {
             source =&gt; "location"
             value_split =&gt; ","
          }
      }
  
  
  }
  
  output {
    elasticsearch {
      hosts =&gt; ["http://localhost:9200"]
      index =&gt; "logstash_apachelogs"
      document_type =&gt; "log"
    }
  }
  </code></pre>
  
  <p>If you have a look at the last <code>kv</code> filter, I've split my location value with a <code>,</code>. I have 2 questions:</p>
  
  <ol>
  <li><p>If you see from the logs I have a <code>location=28.5506382,77.2689024</code> using the kv filter I split the values using the <code>,</code> now how do I use the splited values in a goip filter which takes the vaues as below:</p>
  
  <p>geoip {
  source => "ClientIP"
  target => "geoip"
  add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
  add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}" ]
  }</p></li>
  <li><p>How do i replace the %20 in the query parameter with a white space?</p></li>
  </ol>