# Extract data from CSV column

**URL:** https://discuss.elastic.co/t/extract-data-from-csv-column/277745
**Category:** Logstash
**Created:** [July 4, 2021, 7:32pm UTC](https://discuss.elastic.co/t/extract-data-from-csv-column/277745 "2021-07-04T19:32:25Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![anon33720113](https://avatars.discourse-cdn.com/v4/letter/a/ea666f/32.png) [@anon33720113](https://discuss.elastic.co/u/anon33720113)
#### Post date: [July 4, 2021, 7:32pm UTC](https://discuss.elastic.co/t/extract-data-from-csv-column/277745/1 "2021-07-04T19:32:25Z")

</div>

Hey I have logs as CSV and one column which is in string and has multiple values that need to extracted and stored as new fields.  
The column name is `comment` and it's value is

```auto
VPN token auth failed. Destination was: 62.105.17.111, login name: user2, desc: Authentication failed: Invalid username or password , Auth type: profile"

```

From this column I need to extract:  
ip\_address == 64.135.77.120  
user\_name == Admin  
description == Authentication failed: Invalid username or password

I have following solution but it's not optimal

We can use another grok over that column as

```auto
grok{
match=> ["comment"=> "%{GREEDYDATA:junk} auth %{WORD:action}. %{GREEDYDATA:temp2} %{IPV4:ip_address}, login name: %{WORD:user_name}, %{GREEDYDATA:desc} ,"]
}

```

How can I extract all the required values from the csv column in an optimized way ?

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 4, 2021, 8:02pm UTC](https://discuss.elastic.co/t/extract-data-from-csv-column/277745/2 "2021-07-04T20:02:36Z")

</div>

Personally I would do it using

```
grok {
    break_on_match => false
    match => {
        "comment" => [
            "%{IPV4:ip_address}",
            "login name: %{WORD:user_name},",
            "desc: (?<description>[^,]*),"
        ]
    }
}
```

---

<div class="post-metadata">

### Author: ![anon33720113](https://avatars.discourse-cdn.com/v4/letter/a/ea666f/32.png) [@anon33720113](https://discuss.elastic.co/u/anon33720113)
#### Post date: [July 4, 2021, 8:28pm UTC](https://discuss.elastic.co/t/extract-data-from-csv-column/277745/3 "2021-07-04T20:28:35Z")

</div>

Hey, @Badger, thanks again, I thought there is a missing paranthesis at end of regex

> [@Badger](#):
>
> `"desc: (?<description>[^,]*,`

but even after appending it, the whole `comment`is getting extracted as description. Did you mean to write something else?

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 4, 2021, 8:49pm UTC](https://discuss.elastic.co/t/extract-data-from-csv-column/277745/4 "2021-07-04T20:49:44Z")

</div>

I updated it to add the closing parenthesis.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 1, 2021, 8:49pm UTC](https://discuss.elastic.co/t/extract-data-from-csv-column/277745/5 "2021-08-01T20:49:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.