# Adding Fields and Formatting **URL:** \ **Category:** Logstash\ **Created:** [October 28, 2019, 3:10pm UTC](https://discuss.elastic.co/t/adding-fields-and-formatting/205502 "2019-10-28T15:10:37Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Kernel\_Panic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kernel_panic/32/12294_2.png) [@Kernel\_Panic](https://discuss.elastic.co/u/Kernel_Panic)\ **Post date:** [October 28, 2019, 3:10pm UTC](https://discuss.elastic.co/t/adding-fields-and-formatting/205502/1 "2019-10-28T15:10:37Z")
Hello there I would like to parse / format a log file that at some point it contains the following: **20191016160456 ,PRIORITY,COLOR,APP-NAME~hostname\_instance\_01, process not found** First field is a timestamp, second ( PRIORITY ) is a priority that can be P1,2 or 3 the followed by a state ( COLOR) that can be red, green, yellow then a description of the app having the issue. The problem with this is that if I want to use grok, from what I understood, I have no field name like priority: p1 timestamp: xxxxxxx I have the values itself. Do you have any example of how can I create a new field with add\_field for example so that I have Severity containing P1,2 or 3 , State containing green , red and so on, so then I can make searches on those values? My aim is to create watchers / alerts based on those values. Thanks Regards ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [October 28, 2019, 4:45pm UTC](https://discuss.elastic.co/t/adding-fields-and-formatting/205502/2 "2019-10-28T16:45:51Z")
Have you considered using a csv filter? ---
**Author:** ![Kernel\_Panic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kernel_panic/32/12294_2.png) [@Kernel\_Panic](https://discuss.elastic.co/u/Kernel_Panic)\ **Post date:** [October 28, 2019, 4:51pm UTC](https://discuss.elastic.co/t/adding-fields-and-formatting/205502/3 "2019-10-28T16:51:45Z")
Yes, the format looks like that, but the whole log file is different, is not standard format to say it some way, it contains those lines but is not the whole file like that, can I use the csv filter anyway? Thank you! Regards ---
**Author:** ![Kernel\_Panic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kernel_panic/32/12294_2.png) [@Kernel\_Panic](https://discuss.elastic.co/u/Kernel_Panic)\ **Post date:** [October 28, 2019, 5:35pm UTC](https://discuss.elastic.co/t/adding-fields-and-formatting/205502/4 "2019-10-28T17:35:37Z")
I gave it a try and it seems to have done the trick, it created default fields, column2,3,4 is there a way to change those names? Thanks Regards ---
**Author:** ![Kernel\_Panic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kernel_panic/32/12294_2.png) [@Kernel\_Panic](https://discuss.elastic.co/u/Kernel_Panic)\ **Post date:** [October 28, 2019, 5:43pm UTC](https://discuss.elastic.co/t/adding-fields-and-formatting/205502/5 "2019-10-28T17:43:16Z")
I did it with the mutate filter, thank you guys for the help!! ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [October 28, 2019, 5:48pm UTC](https://discuss.elastic.co/t/adding-fields-and-formatting/205502/6 "2019-10-28T17:48:37Z")
You can use the columns option on the csv filter. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 25, 2019, 5:48pm UTC](https://discuss.elastic.co/t/adding-fields-and-formatting/205502/7 "2019-11-25T17:48:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.