Logstash default value for key

Question

I am using Logstash for parsing appache access_log and i need to retrieve data in key value format from query string of request. I am using kv for split my query string. But some times i get query string like this:

?key1=value1&key2&key3=value3

Is this possible to have default value, like TRUE for example, for keys that haven't got the value?

I don't know wich keys will be send in query string.

My kv config:

kv {
    field_split => "&?"
    source => "params"   
}

Answer 1

Well, the best option I thought is use mutate and gsub

mutate {

     gsub => ["params", "[&,?](((?!\=).)*)[&,\s]", "&\1=true& "]   
}

kv {

     field_split => "&?"
     source => "params"   
}

It is not the best way, you should trim the keys and values after this. I think that only way do this right way is patch kv