# Parse a file as a whole having key value pairs

**URL:** <https://discuss.elastic.co/t/parse-a-file-as-a-whole-having-key-value-pairs/185563>\
**Category:** Logstash\
**Created:** [June 13, 2019, 7:43am UTC](https://discuss.elastic.co/t/parse-a-file-as-a-whole-having-key-value-pairs/185563 "2019-06-13T07:43:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Abhilash\_B](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abhilash_b/32/40270_2.png) [@Abhilash\_B](https://discuss.elastic.co/u/Abhilash_B)\
**Post date:** [June 13, 2019, 7:43am UTC](https://discuss.elastic.co/t/parse-a-file-as-a-whole-having-key-value-pairs/185563/1 "2019-06-13T07:43:24Z")

</div>

I have file which looks like [this](https://pastebin.com/EveQsyK8). I want ship the whole file as an event because I want all the key value pairs (here delimiter is "=") of each file to be part of a single record in Elasticsearch. I am confused about how should I split the event/message and then pass it through the kv filter. Is it possible to split on new line and then send it to kv filter?

Any help regarding this is appreciated. Thanks

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 13, 2019, 4:12pm UTC](https://discuss.elastic.co/t/parse-a-file-as-a-whole-having-key-value-pairs/185563/2 "2019-06-13T16:12:09Z")

</div>

Use a multiline codec to consume the entire file as a single event, then use mutate+gsub to discard the headers, then a kv filter.

```
    mutate { gsub => [ "message", "-{82}
[^
]+ Information
-{82}
", "" ] }
kv { field_split => "
" value_split => "=" remove_field => ["message"] }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 11, 2019, 4:12pm UTC](https://discuss.elastic.co/t/parse-a-file-as-a-whole-having-key-value-pairs/185563/3 "2019-07-11T16:12:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.