# Grok add field after CSV Filter
**URL:** https://discuss.elastic.co/t/grok-add-field-after-csv-filter/207366
**Category:** Logstash
**Created:** [November 11, 2019, 2:14pm UTC](https://discuss.elastic.co/t/grok-add-field-after-csv-filter/207366 "2019-11-11T14:14:31Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@khaag](https://discuss.elastic.co/u/khaag)
#### Post date: [November 11, 2019, 2:14pm UTC](https://discuss.elastic.co/t/grok-add-field-after-csv-filter/207366/1 "2019-11-11T14:14:31Z")
Hi
I have a working csv filter for a syslog event from Palo Alto (SYSTEM)
```
else if ([message] =~ /globalprotect/) {
csv {
source => "message"
columns => [
"FUTURE_USE", "Receive Time", "Serial Number", "Type", "Content/Threat Type", "FUTURE_USE", "Generated Time",
"Virtual System", "Event ID", "Object", "FUTURE_USE", "FUTURE_USE", "Module", "Severity", "Description",
"Sequence Number", "Action Flags", "Device Group Hierarchy Level 1", "Device Group Hierarchy Level 2",
"Device Group Hierarchy Level 3", "Device Group Hierarchy Level 4", "Virtual System Name", "Device Name"
]
}
mutate {
add_tag => ["PAN-OS_GlobalProtect"]
}
```
}
So and now i want to add a grok filter to split the description field into multiple fields:
`GlobalProtect %{WORD:GP-VPNType} (user|client) %{WORD:GP-EventAction} %{WORD:GP-EventResult}. Login from: %{IP:GP-IP}, Source region: %{GREEDYDATA:GP-SourceRegion}, User name: %{USERNAME:GP-Username}?[.\\\",] %{GREEDYDATA:GP-Details}`
The grok filter is working (tested with the debugger)
But i really don't know how to combine this two things 🙂
Thank you very much for your help!
Kind Regards
Kevin
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 9, 2019, 2:14pm UTC](https://discuss.elastic.co/t/grok-add-field-after-csv-filter/207366/2 "2019-12-09T14:14:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.