# Logstash CSV - Changing columns settings based on first character **URL:** \ **Category:** Logstash\ **Created:** [March 21, 2019, 7:52pm UTC](https://discuss.elastic.co/t/logstash-csv-changing-columns-settings-based-on-first-character/173388 "2019-03-21T19:52:40Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Ethical2ak](https://avatars.discourse-cdn.com/v4/letter/e/90db22/32.png) [@Ethical2ak](https://discuss.elastic.co/u/Ethical2ak)\ **Post date:** [March 21, 2019, 7:52pm UTC](https://discuss.elastic.co/t/logstash-csv-changing-columns-settings-based-on-first-character/173388/1 "2019-03-21T19:52:40Z")
Hi, I've came accross this thread [Changing columns based on first character](https://discuss.elastic.co/t/changing-columns-based-on-first-character/112560) , but im not totally sure if its was resolved. I have a CSV file with plenty of entry like this : 7,1553082122,49318237,2019/03/20 07:42:02 049318237,20482,3,silex-buildfarm,silex-buildfarm\_PDC-BLD-177,dm-Login,10.129.19.54/10.0.17.147,,v77,,usage,34.5s,16,1,0,32,0,0,5084,0 9,1553082122,49318237,2019/03/20 07:42:02 049318237,20482,3,silex-buildfarm,silex-buildfarm\_PDC-BLD-177,dm-Login,10.129.19.54/10.0.17.147,,v77,,db,db.user,0,0,0,0,0,3,1,4,0,0,1,0 7,1553082122,49659473,2019/03/20 07:42:02 049659473,25693,1,aradojkovic,~tmp.1553080163.41356.5c921f631f52b8.16444782,user-login,10.129.19.54/10.47.4.115,SWARM,2018.1/1660025 (brokered),-s,usage,1958s,9,3,0,48,0,0,4600,0 9,1553082122,49659473,2019/03/20 07:42:02 049659473,25693,1,aradojkovic,~tmp.1553080163.41356.5c921f631f52b8.16444782,user-login,10.129.19.54/10.47.4.115,SWARM,2018.1/1660025 (brokered),-s,db,db.user,0,0,0,0,0,2,1,2,0,0,1,0 Filebeat is sending the logs towards my logstash. I want logstash to gather only the first digit of each line. Based on that, i would create if statement based on the digit received and set proper columns for each line. My if statement looks like that. if [value] == 7 { csv { ``` separator => "," columns =>["event_type","unix_time","high_precision_time","date","pid","command_number","user","client","function","host","program","version","argument","tracking_type","timer","user_time","system_time","io_read","io_writes","ipc_in","ipc_out","max_physical_mem","page_faults"] } ``` } Im having a hard time to parse the first digit, i can't find a way to put the value into a variable so i can create if statement on this particular value. Im new to ELK , im still trying to figure out what i could do. Is there anything i miss ? Thanks again Charles\_ ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 21, 2019, 8:20pm UTC](https://discuss.elastic.co/t/logstash-csv-changing-columns-settings-based-on-first-character/173388/2 "2019-03-21T20:20:45Z")
``` mutate { copy => { "message" => "firstChar" } } mutate { gsub => ["firstChar", "^(.).*", "\1"] } ``` ---
**Author:** ![Ethical2ak](https://avatars.discourse-cdn.com/v4/letter/e/90db22/32.png) [@Ethical2ak](https://discuss.elastic.co/u/Ethical2ak)\ **Post date:** [March 21, 2019, 8:28pm UTC](https://discuss.elastic.co/t/logstash-csv-changing-columns-settings-based-on-first-character/173388/3 "2019-03-21T20:28:52Z")
Thanks, Does my filter looks ok ? filter { mutate { copy =\> { "message" =\> "firstChar" } } mutate { gsub =\> ["firstChar", "^(.).\*", "\1"] } if [firstChar] == 14 { csv{ ``` separator => "," columns => ["event_type","unix_time","high_precision_time","date","pid","command_number","user","client","function","host","program","version","argument","tracking_type","timer","user_time","system_time","io_read","io_writes","ipc_in","ipc_out","max_physical_mem","page_faults"] } ``` } } I can see that a new field called firstChar as been created. ---
**Author:** ![Ethical2ak](https://avatars.discourse-cdn.com/v4/letter/e/90db22/32.png) [@Ethical2ak](https://discuss.elastic.co/u/Ethical2ak)\ **Post date:** [March 21, 2019, 9:06pm UTC](https://discuss.elastic.co/t/logstash-csv-changing-columns-settings-based-on-first-character/173388/4 "2019-03-21T21:06:20Z")
It seems like "FirstChar" is being indexed. The value inside is ok tho. My if statement also doesn't work , all the columns are not being created for each value between the separator. Its all go into "message" ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 21, 2019, 9:08pm UTC](https://discuss.elastic.co/t/logstash-csv-changing-columns-settings-based-on-first-character/173388/5 "2019-03-21T21:08:28Z")
> [@Ethical2ak](#): > > It seems like "FirstChar" is being indexed. You could change firstChar to [@metadata][firstChar] to avoid that. firstChar is a single character, so "if [firstChar] == 14" will never be true. ---
**Author:** ![Ethical2ak](https://avatars.discourse-cdn.com/v4/letter/e/90db22/32.png) [@Ethical2ak](https://discuss.elastic.co/u/Ethical2ak)\ **Post date:** [March 21, 2019, 9:23pm UTC](https://discuss.elastic.co/t/logstash-csv-changing-columns-settings-based-on-first-character/173388/6 "2019-03-21T21:23:04Z")
Hi, Thanks for the clarification. Indeed , @metadata doesn't index the actual value anymore, which is good. Even with a single value in firstChar, its not creating index for each columns. It seems like my if statement is never true. filter { mutate { copy =\> { "message" =\> "[@metadata][firstChar]" } } mutate { gsub =\> ["[@metadata][firstChar]", "^(.).\*", "\1" ] } if [@metadata][firstChar] == 7 { csv { separator =\> "," columns =\> ["event\_type","unix\_time","high\_precision\_time","date","pid","command\_number","user","client","function","host","program","version","argument","tracking\_type","timer","user\_time","system\_time","io\_read","io\_writes","ipc\_in","ipc\_out","max\_physical\_mem","page\_faults"] } } } When you say replacing firstChar by [@metadata][firstChar] , do i need to replace it for every occurence in the config file ? Regards, ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 21, 2019, 9:51pm UTC](https://discuss.elastic.co/t/logstash-csv-changing-columns-settings-based-on-first-character/173388/7 "2019-03-21T21:51:07Z")
It will be a string, so you need a string comparison. ``` if [@metadata][firstChar] == "7" ``` ---
**Author:** ![Ethical2ak](https://avatars.discourse-cdn.com/v4/letter/e/90db22/32.png) [@Ethical2ak](https://discuss.elastic.co/u/Ethical2ak)\ **Post date:** [March 21, 2019, 9:55pm UTC](https://discuss.elastic.co/t/logstash-csv-changing-columns-settings-based-on-first-character/173388/8 "2019-03-21T21:55:53Z")
Hi Badger, Its working perfectly with > [@Badger](#): > > if [@metadata][firstChar] == "7" Thanks a lot for your support, its really appreciated. You can close this case 🙂 Thanks again. Charles\_ ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 18, 2019, 10:05pm UTC](https://discuss.elastic.co/t/logstash-csv-changing-columns-settings-based-on-first-character/173388/9 "2019-04-18T22:05:26Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.