# Get substrings from the log
**URL:** https://discuss.elastic.co/t/get-substrings-from-the-log/62068
**Category:** Logstash
**Created:** [October 3, 2016, 1:06pm UTC](https://discuss.elastic.co/t/get-substrings-from-the-log/62068 "2016-10-03T13:06:36Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Lego](https://discuss.elastic.co/u/Lego)
#### Post date: [October 3, 2016, 1:06pm UTC](https://discuss.elastic.co/t/get-substrings-from-the-log/62068/1 "2016-10-03T13:06:36Z")
Hello.
Could you kindly help me to solve one little problem?
I have log strings look like as:
20160919;11:09:32;Username;E;Creating Report;ReportName;3;ReportNameAgain|11:09:32|1|02.07.2016|02.08.2016;;
I load them to logstash using csv and everything works fine.
But I need to get some substrings each in own field. I marked desireable substring bold.
Please see an example below:
20160919;11:09:32;Username;E;Creating Report;ReportName;3; **ReportNameAgain|11:09:32|1|02.07.2016|02.08.2016** ;;
I'd like to get following result:
ReportNameAgain =\> Field named "ReportName"
11:09:32 =\> Field "Start time"
1 =\> Report status
02.07.2016 =\> BeginReport
02.08.2016 =\> EndReport
The difficulty is another delimiter "|"
I don't know how to work with it. I'm newbie in logstash, so I'd like to ask you to help me to solve this issue.
Thanks in advance.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 3, 2016, 1:11pm UTC](https://discuss.elastic.co/t/get-substrings-from-the-log/62068/2 "2016-10-03T13:11:04Z")
You can use the csv filter a second time on the field with the "|" characters.
---
### Author:  [@Lego](https://discuss.elastic.co/u/Lego)
#### Post date: [October 6, 2016, 2:04pm UTC](https://discuss.elastic.co/t/get-substrings-from-the-log/62068/3 "2016-10-06T14:04:41Z")
Hello and thank you for your reply.
Unfortunatelly I don't know how to point csv field as a source.
Here is my filter section example.
filter {
if [type] == "logerp"
{
csv
{
columns =\> [
"ReportDate","ReportTime","UserName","ErpMode","Action","ReportName","QueryType","ReportData","Field1","Field2"
]
separator =\> ";"
}
}
}
If I understood correctly I need to use field named "ReportData" as a source for second csv section.
Could you give me advice how to implement this action?
Thanks in advance!
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 6, 2016, 2:22pm UTC](https://discuss.elastic.co/t/get-substrings-from-the-log/62068/4 "2016-10-06T14:22:10Z")
Set the csv filter's `source` option to the name of the field you want it to parse.
---
### Author:  [@Lego](https://discuss.elastic.co/u/Lego)
#### Post date: [October 11, 2016, 9:04am UTC](https://discuss.elastic.co/t/get-substrings-from-the-log/62068/5 "2016-10-11T09:04:07Z")
Thanks a lot for your advice. It works.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:34am UTC](https://discuss.elastic.co/t/get-substrings-from-the-log/62068/6 "2017-07-06T04:34:47Z")