# Logstash CSV String Text containing commas

**URL:** https://discuss.elastic.co/t/logstash-csv-string-text-containing-commas/62730
**Category:** Logstash
**Created:** [October 11, 2016, 3:39pm UTC](https://discuss.elastic.co/t/logstash-csv-string-text-containing-commas/62730 "2016-10-11T15:39:01Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Wayne\_Taylor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wayne_taylor/32/45984_2.png) [@Wayne\_Taylor](https://discuss.elastic.co/u/Wayne_Taylor)
#### Post date: [October 11, 2016, 3:39pm UTC](https://discuss.elastic.co/t/logstash-csv-string-text-containing-commas/62730/1 "2016-10-11T15:39:01Z")

</div>

Dear Logstash Community,

Need your help. I am facing an issue with Network Switch Traffic that comes in the form of CSV files. The problem is some of the fields contain commas in it e.g. a URL and the string isn't encapsulated within quotation marks.

For example URL = [http://url.com/search.?aspx=feed1@x1,x2,x3](http://url.com/search.?aspx=feed1@x1,x2,x3)

What happens is now my message is and columns are blown out and I get something like:

URL, Bytes, column 30, column 31 etc. Where column 30 and 31 is new columns added by the CSV filter.

Below is my logstash conf file:

```
input {
file {
	path => "/Users/wtaylor/Downloads/logstash-2.2.2/bin/sce/*.csv"
	type => "usage"
	start_position => "beginning"
    }
    }

filter {
csv {
	columns => [
			"TIMESTAMP",
			"DUMMY",
			"SUBSCRIBER_ID",
			"PACKAGE_ID",
			"SERVICE_ID",
			"PROTOCOL_ID",
			"SKIPPED_SESSIONS",
			"SERVER_IP",
			"SERVER_PORT",
			"ACCESS_STRING",
			"INFO_STRING",
			"CLIENT_IP",
			"CLIENT_PORT",
			"INITIATING_SIDE",
			"REPORT_TIME",
			"MILLISEC_DURATION",
			"TIME_FRAME",
			"SESSION_UPSTREAM_VOLUME",
			"SESSION_DOWNSTREAM_VOLUME",
			"SUBSCRIBER_COUNTER_ID",
			"GLOBAL_COUNTER_ID",
			"PACKAGE_COUNTER_ID",
			"IP_PROTOCOL",
			"PROTOCOL_SIGNATURE",
			"ZONE_ID",
			"FLAVOR_ID",
			"FLOW_CLOSE_IP_TYPE",
			"SERVERIPv6ADDRESS",
			"CLIENTIPv6ADDRESS"
		]
separator => ","
}
}

output {
    stdout { codec => json_lines }
}

```

I ideally need to get length of the array if split by commas and join the extra commas one of the fields e.g. INFO\_STRING

Does anyone know how to achieve this.

Wayne

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:34am UTC](https://discuss.elastic.co/t/logstash-csv-string-text-containing-commas/62730/2 "2017-07-06T04:34:42Z")

</div>