How does the logstash kv{} filter plugin work?

Question

I wanted to extract url query params and as per this forum answer I was able to do it with kv{}

But I want to understand how this works.

Here is my string: param1=val1&param2=val2&adv=val3&param3=val4&param4=val5

Now I have that field extracted in logstash as uri_query.

So then I use kv like this:

kv {
  source => "uriQuery"
  field_split => "&"
  prefix => "query_"
}

And I get fields for each query param:

query_param1 val1
query_param2 val2
etc

But what I don't understand is how it knows to strip out and break on the "=". Is that like the default token for kv's key=value syntax or something?

Answer 1

Yep. = is the default token for kv.

Here is the documentation about that parameter for the kv plugin which is called value_split.