# Applying grok on a field value after csv plugin
**URL:** https://discuss.elastic.co/t/applying-grok-on-a-field-value-after-csv-plugin/55029
**Category:** Logstash
**Created:** [July 8, 2016, 9:05am UTC](https://discuss.elastic.co/t/applying-grok-on-a-field-value-after-csv-plugin/55029 "2016-07-08T09:05:49Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@pvignesh92](https://discuss.elastic.co/u/pvignesh92)
#### Post date: [July 8, 2016, 9:05am UTC](https://discuss.elastic.co/t/applying-grok-on-a-field-value-after-csv-plugin/55029/1 "2016-07-08T09:05:49Z")
Hi team, I have a csv file which contains the output from Oracle tables. We are using csv filter to parse the data to appropriate fields. A field in them has a value which is a command getting executed.
Ex. /home/run [job.pl](http://job.pl) --job="job\_name"
I need to apply grok pattern on that particular field and extract only that job name and assign it to a different field. Confused if this is possible.
Any help on this.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 8, 2016, 9:11am UTC](https://discuss.elastic.co/t/applying-grok-on-a-field-value-after-csv-plugin/55029/2 "2016-07-08T09:11:02Z")
Yes, it's possible. The grok filter parses text. It doesn't know or care about if that text originally came from a CSV file. For further help please show your current configuration and an example input line.
---
### Author:  [@pvignesh92](https://discuss.elastic.co/u/pvignesh92)
#### Post date: [July 8, 2016, 9:52am UTC](https://discuss.elastic.co/t/applying-grok-on-a-field-value-after-csv-plugin/55029/3 "2016-07-08T09:52:26Z")
Thanks for the response Magnus.
This is my dummy input file
08-JUL-16~;order\_id~;appl\_id~;job\_name\_old~;Night Job~;/home/job.pl --job="job\_name"'~;
And this is my csv filter
csv {
columns =\> ["system\_date","order\_id","appl\_id","job\_name\_old","description","cmd\_line",
separator =\> "~;"
}
Need to write a grok to parse the field 'cmd\_line' and assign just the content within double codes ( --job=" ") to another field like job\_cmd.
Thanks.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 8, 2016, 11:22am UTC](https://discuss.elastic.co/t/applying-grok-on-a-field-value-after-csv-plugin/55029/4 "2016-07-08T11:22:35Z")
Untested but should work:
```nohighlight
filter {
grok {
match => {
"cmd_line" => ' --job="(?[^"]+)"'
}
}
}
```
---
### Author:  [@pvignesh92](https://discuss.elastic.co/u/pvignesh92)
#### Post date: [July 8, 2016, 11:58am UTC](https://discuss.elastic.co/t/applying-grok-on-a-field-value-after-csv-plugin/55029/5 "2016-07-08T11:58:02Z")
Hi Magnus, Thanks for the response.
I tried this but don't see a new field getting created with the value.
My Config
```
csv {
columns => ["system_date","order_id","appl_id","ControlM_job_name","description","cmd_line","cpu_id","owner","from_time","to_time", "cyclic", "next_run_time", "status", "odate", "rerun_counter", "order_table", "application", "group_name", "job_id", "elapsed_runtime", "cpu_time", "memname", "state", "nodegroup","data_center","avg_start_time","avg_run_time","start_date","start_time","end_date","end_time"]
separator => "~;"
add_field => { "[technology]" => "Tech_name"
"[field2]" => "%{memname}"
"[field3]" => "%{nodegroup}"
}
}
grok {
match => {
"cmd_line" => ' --job="(?[^"]+)"'
}
```
}
Could you kindly check. The value of that field is /home/job.pl --job="job\_name"
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 10, 2016, 8:31am UTC](https://discuss.elastic.co/t/applying-grok-on-a-field-value-after-csv-plugin/55029/6 "2016-07-10T08:31:34Z")
Please show the result of a `stdout { codec => rubydebug }` output so we can see what's going on.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:48am UTC](https://discuss.elastic.co/t/applying-grok-on-a-field-value-after-csv-plugin/55029/7 "2017-07-06T04:48:46Z")