# Compare field value with field from csv , database and set a new field **URL:** \ **Category:** Logstash\ **Created:** [January 28, 2019, 1:32pm UTC](https://discuss.elastic.co/t/compare-field-value-with-field-from-csv-database-and-set-a-new-field/166001 "2019-01-28T13:32:43Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![TEJASWI\_CHUNDURI](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tejaswi_chunduri/32/46271_2.png) [@TEJASWI\_CHUNDURI](https://discuss.elastic.co/u/TEJASWI_CHUNDURI)\ **Post date:** [January 28, 2019, 1:32pm UTC](https://discuss.elastic.co/t/compare-field-value-with-field-from-csv-database-and-set-a-new-field/166001/1 "2019-01-28T13:32:44Z")
My events are having fields like **timestamp, version , sitename , url** and **score** Whenever the data parsed to logstash , I want to compare the **score** field of the url fields between different **version** field. As i have searched and found i can't make dynamic compare on same fields between different events which is my intial approach. So i want to keep some static data in csv like url, score fields and once the data approached to logstash will try to find the url from csv file and compare the score field based on the difference of the score value i want to set a new field like Positive , negative, neutral ?? Can anyone help above mentioned approaches are feasible or not ? @magnusbaeck @Badger @bardie ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [January 28, 2019, 3:00pm UTC](https://discuss.elastic.co/t/compare-field-value-with-field-from-csv-database-and-set-a-new-field/166001/2 "2019-01-28T15:00:19Z")
You could do this using a [translate](https://www.elastic.co/guide/en/logstash/current/plugins-filters-translate.html) filter. Have a csv containing url,score and do a lookup of the url to a new destination, then compare the destination to the score in the message and mutate+add\_field appropriately based on the comparison. ---
**Author:** ![TEJASWI\_CHUNDURI](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tejaswi_chunduri/32/46271_2.png) [@TEJASWI\_CHUNDURI](https://discuss.elastic.co/u/TEJASWI_CHUNDURI)\ **Post date:** [January 28, 2019, 5:31pm UTC](https://discuss.elastic.co/t/compare-field-value-with-field-from-csv-database-and-set-a-new-field/166001/3 "2019-01-28T17:31:51Z")
@Badger i checked translate filter , can we send the dynamic value to the dictionary\_path mutate{ add\_field =\> {"csv\_path" =\> "/etc/logstash/reports/%{fsite}\_%{url}.csv"} } translate { field =\> "[url\_type\_uniqref]" destination =\> "[new\_cwe]" dictionary\_path =\> "%{csv\_path}" exact =\> true regex =\> true } ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [January 28, 2019, 5:53pm UTC](https://discuss.elastic.co/t/compare-field-value-with-field-from-csv-database-and-set-a-new-field/166001/4 "2019-01-28T17:53:14Z")
No, I do not believe a sprintf reference will work there. ---
**Author:** ![TEJASWI\_CHUNDURI](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tejaswi_chunduri/32/46271_2.png) [@TEJASWI\_CHUNDURI](https://discuss.elastic.co/u/TEJASWI_CHUNDURI)\ **Post date:** [January 29, 2019, 6:09am UTC](https://discuss.elastic.co/t/compare-field-value-with-field-from-csv-database-and-set-a-new-field/166001/5 "2019-01-29T06:09:43Z")
Is there any workaround ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 26, 2019, 6:09am UTC](https://discuss.elastic.co/t/compare-field-value-with-field-from-csv-database-and-set-a-new-field/166001/6 "2019-02-26T06:09:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.