# Import CSV and update multi value field

**URL:** <https://discuss.elastic.co/t/import-csv-and-update-multi-value-field/124514>\
**Category:** Logstash\
**Created:** [March 19, 2018, 9:17am UTC](https://discuss.elastic.co/t/import-csv-and-update-multi-value-field/124514 "2018-03-19T09:17:48Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![kevkos236](https://avatars.discourse-cdn.com/v4/letter/k/90ced4/32.png) [@kevkos236](https://discuss.elastic.co/u/kevkos236)\
**Post date:** [March 19, 2018, 9:17am UTC](https://discuss.elastic.co/t/import-csv-and-update-multi-value-field/124514/1 "2018-03-19T09:17:48Z")

</div>

Greetings,

I'm importing large CSV files into elasticsearch using logstash. I'm prefixing specific values like this:

```
    filter {      
       if [path] =~ "xyz" {
         csv {
              separator => ";"
             columns =>
              [
                "IOT",
              "name",
                "surname",
               "addr",
               "XID",
               "ticketid"
              ]
          }

           if [IOT]{
           mutate {
              update => { "IOT" => "v-%{IOT}" }
          }
            } 

```

Recently we discovered multi values fields in those files and now I want to add the prefix to each value in the field.

Example.csv

```
 IOT;name;surname;addr;XID;ticketid
 1;Mueller;Hans;42553;1;['9', '12', '13', '14']
 2;Meier;Peter;42873;2;['8', '14']

```

Right now those lines are beeing read like `v-['8', '14']`.

The output I need is something like `[v-8, v-14]`.

Is there a way to achieve this in the logstash config? Maybe something like for each statement?

Also not sure if the multi value syntax in the csv is correct.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 16, 2018, 9:17am UTC](https://discuss.elastic.co/t/import-csv-and-update-multi-value-field/124514/2 "2018-04-16T09:17:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.