# Capture events from only first half of a file in composite format **URL:** \ **Category:** Logstash\ **Created:** [May 15, 2019, 11:29am UTC](https://discuss.elastic.co/t/capture-events-from-only-first-half-of-a-file-in-composite-format/181164 "2019-05-15T11:29:58Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Abhilash\_B](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abhilash_b/32/40270_2.png) [@Abhilash\_B](https://discuss.elastic.co/u/Abhilash_B)\ **Post date:** [May 15, 2019, 11:29am UTC](https://discuss.elastic.co/t/capture-events-from-only-first-half-of-a-file-in-composite-format/181164/1 "2019-05-15T11:29:58Z")
I have files which looks [like this](https://pastebin.com/edR6afrP). My logstash pipeline looks [like this](https://pastebin.com/SnT6dGcf) (Have omitted the output part intentionally). I require only the top part of the file which essentially consists of key value pairs as in single record in Elasticsearch along with some other fields like **date, time, version** by parsing specific sentences like `The deployment started 3/19/2019 at 2:05` and `Rev = CTRL_VER = 2.18_SmartMicrov3.a_TC16MPv5.0 at site KX028`. 1. My first issue is, the values of some key look mixed up, i.e although in ES we have source as file1.log whose key1=value1, in ES I see "key1":"value2". Looks like my termination condition to send the event to output is wrong? 2. Secondly, is there a way to check for end of file in logstash filter part? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 12, 2019, 11:29am UTC](https://discuss.elastic.co/t/capture-events-from-only-first-half-of-a-file-in-composite-format/181164/2 "2019-06-12T11:29:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.