# Adding fields from csv to event that's a log

**URL:** <https://discuss.elastic.co/t/adding-fields-from-csv-to-event-thats-a-log/29808>\
**Category:** Elasticsearch\
**Created:** [September 22, 2015, 7:38pm UTC](https://discuss.elastic.co/t/adding-fields-from-csv-to-event-thats-a-log/29808 "2015-09-22T19:38:21Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![bennett](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bennett/32/4903_2.png) [@bennett](https://discuss.elastic.co/u/bennett)\
**Post date:** [September 22, 2015, 7:38pm UTC](https://discuss.elastic.co/t/adding-fields-from-csv-to-event-thats-a-log/29808/1 "2015-09-22T19:38:21Z")

</div>

Hi,

i'm using log stash to forward a static file which is csv and a another log stash instance sending log files.

I'm able to get both csv and log into the same index. They both have the same value in the "key" field.

basically what i want to do is....  
If key in .csv == key in log event then add other fields from .csv row in log events so i can view all fields in the same event in kibana.

another way to view this is...  
server 1 sending .csv has:  
key, username, email, company  
h39hs, smith123, [smith123@smith.com](mailto:smith123@smith.com), smith inc

server 2 sending log has:  
id - key - ip - - time GET query  
0 - h39hs - 127.0.0.1 -- [22/Sep/2015:19:03:15 +0000] /some/query/here

in kibana i want to view:  
0 - h39hs - 127.0.0.1 -- [22/Sep/2015:19:03:15 +0000] /some/query/here smith123, [smith123@smith.com](mailto:smith123@smith.com), smith inc

It matches at key and so i see what email when with what requests.

Is there a way to do this? I'm using the latest stable build of logstash, elasticsearch, and kibana

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 23, 2015, 1:23am UTC](https://discuss.elastic.co/t/adding-fields-from-csv-to-event-thats-a-log/29808/2 "2015-09-23T01:23:57Z")

</div>

This might be what you want [https://github.com/alcanzar/logstash-filter-memorize](https://github.com/alcanzar/logstash-filter-memorize)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 11:48pm UTC](https://discuss.elastic.co/t/adding-fields-from-csv-to-event-thats-a-log/29808/3 "2017-07-05T23:48:40Z")

</div>


