# Index the content of KV file with Logstash in one document dynamically
**URL:** https://discuss.elastic.co/t/index-the-content-of-kv-file-with-logstash-in-one-document-dynamically/203210
**Category:** Logstash
**Created:** [October 11, 2019, 10:34am UTC](https://discuss.elastic.co/t/index-the-content-of-kv-file-with-logstash-in-one-document-dynamically/203210 "2019-10-11T10:34:25Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Bouraoui\_Kacem](https://discuss.elastic.co/u/Bouraoui_Kacem)
#### Post date: [October 11, 2019, 10:34am UTC](https://discuss.elastic.co/t/index-the-content-of-kv-file-with-logstash-in-one-document-dynamically/203210/1 "2019-10-11T10:34:25Z")
I have many properties files with the following structures key = Value , for example :
```auto
rejets.cache.temporaire.time=60
data.cache.referentiel.time=10
data.cache.temporaire.time=60
data.cache.getinfos.time=200
```
I want to index this file as a document elasticsearch dynamicaly (the name of the field ) like this :
```auto
{
rejets.cache.temporaire.time:60
data.cache.referentiel.time:10
data.cache.temporaire.time:60
data.cache.getinfos.time:200
}
```
I used the following configuration but i found in my index each field is indexed in one document ,so in my case i have 4 documents indexed :
```auto
mutate {
gsub => ["message", "[\\\\]r", "esp" ]
gsub => ["message", "[\\\\]n", "ace" ]
}
ruby {
code => "begin; event['message'] = event['message'].split(/espace/); rescue Exception; end"
}
kv {
source => "message"
value_split => "="
field_split => "\n"
}
grok {
match => { "message" => "(?[^=]*)=%{GREEDYDATA:value}" }
}
if "_grokparsefailure" in [tags] {
drop {}
}
mutate {
remove_field => ["message"]
}
```
I want to have one document indexed with all the fields of the properties file
How can i make this please ? thanks for Help
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [October 11, 2019, 3:51pm UTC](https://discuss.elastic.co/t/index-the-content-of-kv-file-with-logstash-in-one-document-dynamically/203210/2 "2019-10-11T15:51:10Z")
Use a multiline codec on the input to combine all of the lines into a single event. Do this by using a pattern that never matches and a timeout
```
codec => multiline { pattern => "^Spalanzani" negate => true what => previous auto_flush_interval => 1 multiline_tag => "" }
```
Then use a kv filter with a literal newline in the field\_split option
```
kv { field_split => "
" value_split => "=" }
```
---
### Author:  [@Bouraoui\_Kacem](https://discuss.elastic.co/u/Bouraoui_Kacem)
#### Post date: [October 14, 2019, 9:55am UTC](https://discuss.elastic.co/t/index-the-content-of-kv-file-with-logstash-in-one-document-dynamically/203210/3 "2019-10-14T09:55:07Z")
Thank you for your help !
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 11, 2019, 9:55am UTC](https://discuss.elastic.co/t/index-the-content-of-kv-file-with-logstash-in-one-document-dynamically/203210/4 "2019-11-11T09:55:10Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.