# CSV filter in logstash question

**URL:** <https://discuss.elastic.co/t/csv-filter-in-logstash-question/172649>\
**Category:** Logstash\
**Created:** [March 16, 2019, 7:34pm UTC](https://discuss.elastic.co/t/csv-filter-in-logstash-question/172649 "2019-03-16T19:34:32Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![johnfowles](https://avatars.discourse-cdn.com/v4/letter/j/91b2a8/32.png) [@johnfowles](https://discuss.elastic.co/u/johnfowles)\
**Post date:** [March 16, 2019, 7:34pm UTC](https://discuss.elastic.co/t/csv-filter-in-logstash-question/172649/1 "2019-03-16T19:34:33Z")

</div>

How would you add a tag to a column that has been parsed by the CSV plugin?

For instance, I have the following and it gets all the columns indexed, but it does not add tags to the matching [sourcetype] regex.

```
filter {
  if [type] == "csv" {
    csv {
      separator => ","
      columns => ["timestamp", "source", "sourcetype", "host", "index", "raw"]
      remove_field => ["message"]
      add_tag => ["csv"]
    }
    grok {
      match => ["timestamp", "%{TIMESTAMP_ISO8601:timestamp} %{WORD:timezone}"]
      overwrite => ["timestamp"]
    }
    date{
      #match => ["timestamp", "YYYY-MM-dd HH:mm:ss,SSS"]
      match => ["timestamp", "ISO8601"]
    }
    if [sourcetype] =~ /^vpc$/ {
      mutate {
        add_tag => ["vpc"]
      }
    }
    if [sourcetype] =~ /^iis$/ {
      mutate {
        add_tag => ["iis"]
      }
    }
  }
}
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 16, 2019, 7:58pm UTC](https://discuss.elastic.co/t/csv-filter-in-logstash-question/172649/2 "2019-03-16T19:58:18Z")

</div>

> [@johnfowles](#):
>
> if [sourcetype] =~ /^vpc$/ { mutate { add\_tag =\> ["vpc"] } }

If you are anchoring both the beginning and end of a string I think it would be clearer to use a simple string equality test.

```
if [sourcetype] == "vpc" {
    [...]

```

---

<div class="post-metadata">

**Author:** ![johnfowles](https://avatars.discourse-cdn.com/v4/letter/j/91b2a8/32.png) [@johnfowles](https://discuss.elastic.co/u/johnfowles)\
**Post date:** [March 16, 2019, 8:00pm UTC](https://discuss.elastic.co/t/csv-filter-in-logstash-question/172649/3 "2019-03-16T20:00:23Z")

</div>

The sourcetype column can have multiple entries for the string vpc, for instance it could be vpc1, vpc2... So I though I would have to regex match it?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 16, 2019, 8:03pm UTC](https://discuss.elastic.co/t/csv-filter-in-logstash-question/172649/4 "2019-03-16T20:03:38Z")

</div>

Yes, but the ^ and $ anchor the regexp to start of string and end of string, so ^vpc$ only matches the exact string vpc.

If you want any string containing vpc use /vpc/. If you want any string beginning with vpc use /^vpc/.

---

<div class="post-metadata">

**Author:** ![johnfowles](https://avatars.discourse-cdn.com/v4/letter/j/91b2a8/32.png) [@johnfowles](https://discuss.elastic.co/u/johnfowles)\
**Post date:** [March 16, 2019, 8:08pm UTC](https://discuss.elastic.co/t/csv-filter-in-logstash-question/172649/5 "2019-03-16T20:08:20Z")

</div>

Umm, yeah... Wow, it's been a long day. Thanks Badger for the sanity check!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 13, 2019, 8:08pm UTC](https://discuss.elastic.co/t/csv-filter-in-logstash-question/172649/6 "2019-04-13T20:08:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.