# Create new columns from one column value

**URL:** <https://discuss.elastic.co/t/create-new-columns-from-one-column-value/148603>\
**Category:** Logstash\
**Created:** [September 14, 2018, 10:28am UTC](https://discuss.elastic.co/t/create-new-columns-from-one-column-value/148603 "2018-09-14T10:28:37Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Varun\_Goyal](https://avatars.discourse-cdn.com/v4/letter/v/ce7236/32.png) [@Varun\_Goyal](https://discuss.elastic.co/u/Varun_Goyal)\
**Post date:** [September 14, 2018, 10:28am UTC](https://discuss.elastic.co/t/create-new-columns-from-one-column-value/148603/1 "2018-09-14T10:28:37Z")

</div>

I have a csv columns as:

Data1,Data2,"Product: XYZ\r\nVersion: 1.0.0\r\nLanguage: English\r\nDate: Wednesday, September 12, 2018\r\n"

By using filter I am able to get data in columns, here is my filter:

csv {  
#autodetect\_column\_names =\> true  
columns =\> ["F1","F2","F3"]  
source =\> "message"

}  
mutate {  
add\_field =\> { "NEW\_FIELD" =\> "%{F1}" }  
}

I want to split F3 Data which is:  
"Product: XYZ\r\nVersion: 1.0.0\r\nLanguage: English\r\nDate: Wednesday, September 12, 2018\r\n"  
in key value pair.

Can any one help how can i achieve this ?

---

<div class="post-metadata">

**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\
**Post date:** [September 14, 2018, 5:29pm UTC](https://discuss.elastic.co/t/create-new-columns-from-one-column-value/148603/2 "2018-09-14T17:29:45Z")

</div>

First, you may want to use the Mutate Filter Plugin's `copy` directive, which is a little nicer about copying edge-case values than `add_field` with string interpolation.

```auto
mutate {
  copy => {
    "F1" => "NEW_FIELD"
  }
}

```

Next, You could likely use the [KV Filter Plugin](https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html) to split out the key/value pairs from the `F3` field:

```auto
kv {
  source => "F3"
  field_split => "\n"
  value_split => ":"
  trim_value => "\r\s" # trim carriage-returns and whitespace from beginning and end of value 
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 12, 2018, 5:29pm UTC](https://discuss.elastic.co/t/create-new-columns-from-one-column-value/148603/3 "2018-10-12T17:29:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.