# Logstash- extraction of data from a column in csv

**URL:** https://discuss.elastic.co/t/logstash-extraction-of-data-from-a-column-in-csv/75284
**Category:** Logstash
**Created:** [February 16, 2017, 6:18am UTC](https://discuss.elastic.co/t/logstash-extraction-of-data-from-a-column-in-csv/75284 "2017-02-16T06:18:56Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![nilanjana](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nilanjana/32/15965_2.png) [@nilanjana](https://discuss.elastic.co/u/nilanjana)
#### Post date: [February 16, 2017, 6:18am UTC](https://discuss.elastic.co/t/logstash-extraction-of-data-from-a-column-in-csv/75284/1 "2017-02-16T06:18:56Z")

</div>

Hi ,

I have a csv file with where the is a column called "description" which has got random lines and varies with each record in csv . For one of the record it looks like this :

_ **JOB RUN: 'AAL ATLAS ETL ATRMS Recipe' was run on 9/28/2016 at 6:05:00 AM** _

_ **DURATION: 0 hours, 48 minutes, 21 seconds** _

_ **STATUS: Failed** _

_**MESSAGES: The job failed. The Job was invoked by Schedule 97 (JobSchedule). The last step to run was step 7 (AtlasEtlAtrmsRecipeParameterInstance).**_

Now how do I parse it using logstash? I have tried using csv filter but since there are comma separated values inside the fields also (like description field) I not able to parse it properly. Please suggest how can I filter my data and insert. Also if there is certain value inside a field , eg : in "description" I want to retrieve the value for "STATUS" then how do I do the extraction?

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [February 16, 2017, 7:05am UTC](https://discuss.elastic.co/t/logstash-extraction-of-data-from-a-column-in-csv/75284/2 "2017-02-16T07:05:58Z")

</div>

This is a job for either the grok filter or possibly the dissect filter.

---

<div class="post-metadata">

### Author: ![nilanjana](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nilanjana/32/15965_2.png) [@nilanjana](https://discuss.elastic.co/u/nilanjana)
#### Post date: [February 16, 2017, 7:11am UTC](https://discuss.elastic.co/t/logstash-extraction-of-data-from-a-column-in-csv/75284/3 "2017-02-16T07:11:15Z")

</div>

Thanks magnus. could you please give me an example? For the record highlighted above ?

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [February 16, 2017, 7:29am UTC](https://discuss.elastic.co/t/logstash-extraction-of-data-from-a-column-in-csv/75284/4 "2017-02-16T07:29:00Z")

</div>

I don't have time for that, but [http://grokconstructor.appspot.com/](http://grokconstructor.appspot.com/) can assist you in crafting a grok expression.

---

<div class="post-metadata">

### Author: ![nilanjana](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nilanjana/32/15965_2.png) [@nilanjana](https://discuss.elastic.co/u/nilanjana)
#### Post date: [February 16, 2017, 7:30am UTC](https://discuss.elastic.co/t/logstash-extraction-of-data-from-a-column-in-csv/75284/5 "2017-02-16T07:30:28Z")

</div>

This is great. Thanks!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 16, 2017, 7:30am UTC](https://discuss.elastic.co/t/logstash-extraction-of-data-from-a-column-in-csv/75284/6 "2017-03-16T07:30:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
