Parse Key Value

Parses a string of key-value pairs (for example action=login status=success) from a source field into a structured map, then writes the result to a target field. You control the delimiter that splits each key from its value and the delimiter that separates one pair from the next.

Supported Telemetry Types

Logs	Metrics	Traces
✓	✓	✓

Choose Telemetry Type picks one signal per processor instance. Add another instance to handle a second signal.

Configuration

Basic Configuration

Selection

Parameter	Type	Required	Default	Description
Choose Telemetry Type	Telemetry Selector	Yes	Logs	The signal this instance runs on: Logs, Metrics, or Traces (one at a time).
Condition	OTTL Condition	No	(empty)	Parse only the records that match. Empty runs on every record.

Source and target fields

Parameter	Type	Required	Default	Description
Source Field Type	Enum: Resource, Attributes, Body, Custom	Yes	Attributes	Where the key-value string is read from. Body is logs-only. Custom takes any OTTL path.
Source Field	OTTL Field	Yes *	(empty)	The field holding the key-value string. For a Body source, leave empty to parse the entire body.
Target Field Type	Enum: Resource, Attributes, Body, Custom	Yes	Attributes	Where the parsed map is written. Body is logs-only. Custom takes any OTTL path.
Target Field	OTTL Field	Yes *	(empty)	Destination for the parsed map. Leave empty to merge the parsed pairs into the chosen target context (resource, attributes, or body) instead of nesting them under a new field.

* The Body field type is the exception: it's optional, and leaving it empty targets the entire body. For Metrics and Traces the field type options are Resource, Attributes, and Custom (no Body).

Delimiters

Parameter	Type	Required	Default	Description
Pair Delimiter	String	No	(empty)	The string separating one pair from the next. Leave empty to use a single space.
Delimiter	String	No	(empty)	The string separating each key from its value. Leave empty to use =.

Examples

Parse a key-value attribute into structured fields

A log carries event details as a single attribute string:

{
  "level": "info",
  "eventDetails": "action:login!status:success"
}

To split that into addressable fields, set:

• Choose Telemetry Type: Logs
• Condition: attributes["eventDetails"] != nil
• Source Field Type: Attributes
• Source Field: eventDetails
• Target Field Type: Attributes
• Target Field: parsedEventDetails
• Pair Delimiter: !
• Delimiter: :

The result keeps the original string and adds the parsed map:

{
  "level": "info",
  "eventDetails": "action:login!status:success",
  "parsedEventDetails": {
    "action": "login",
    "status": "success"
  }
}

Configuration Tips

• The default Delimiter is = and the default Pair Delimiter is a single space, so a string like host=web01 region=us-east parses with no delimiter changes. Override both only when your data uses other separators.
• Leave Target Field empty to merge the parsed keys directly into the chosen context (attributes, resource, or body). Set a Target Field name to nest the parsed map under that single field instead.

Troubleshooting

The target field is empty or unchanged

Symptoms: no parsed map appears after the processor runs.

Solutions:

1. Confirm the source field actually holds a key-value string and the Condition evaluates true.
2. Check that the Delimiter and Pair Delimiter match the separators in your data. The wrong delimiter yields no usable pairs.

Parsed values land in the wrong place

Symptoms: keys merge into a context you didn't expect, or overwrite existing fields.

Solutions:

1. Leaving Target Field empty merges keys into the whole target context. Set an explicit Target Field name to keep them isolated under one field.
2. Parsing from Body or Attributes into the Resource field is not supported.

Standalone Processor

apiVersion: bindplane.observiq.com/v1
kind: Processor
metadata:
  name: parse-key-value
spec:
  type: parse_key_value
  parameters:
    - name: telemetry
      value: Logs
    - name: condition
      value: attributes["eventDetails"] != nil
    - name: logs_source_field_type
      value: Attributes
    - name: logs_attribute_source_field
      value: eventDetails
    - name: logs_target_field_type
      value: Attributes
    - name: logs_attribute_target_field
      value: parsedEventDetails
    - name: pair_delimiter
      value: "!"
    - name: delimiter
      value: ":"

Related Resources

• ParseKeyValue — OTTL function reference

Bindplane Resources

These parsers turn raw field text into structured data. Chain them to normalize and parse telemetry end to end:

• Parse JSON
• Parse CSV
• Parse with Regex
• Parse Severity
• Parse Timestamp