# Need to Split the Value in the Message

**URL:** <https://discuss.elastic.co/t/need-to-split-the-value-in-the-message/237217>\
**Category:** Logstash\
**Created:** [June 16, 2020, 5:02am UTC](https://discuss.elastic.co/t/need-to-split-the-value-in-the-message/237217 "2020-06-16T05:02:54Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Prithviraj\_Tantubay](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/prithviraj_tantubay/32/43674_2.png) [@Prithviraj\_Tantubay](https://discuss.elastic.co/u/Prithviraj_Tantubay)\
**Post date:** [June 16, 2020, 5:02am UTC](https://discuss.elastic.co/t/need-to-split-the-value-in-the-message/237217/1 "2020-06-16T05:02:54Z")

</div>

I need help in splitting the value in message field and update the result in the remaining respective fields.  
I have a row data in .csv file in the following format:  
"NA","GIXRG051/Genpact/Consultant","5/1/2020 2:10","5/1/2020 2:12","5/1/2020 2:12","RIXRM006","NA","NA","NA","NA","NA","NA","NA","NA","NA","NA","NA","NA","NA","FSC JE EMEA/FSC/PL","RE: 453-santander 27","453 Santander 27 Apr 2020.xlsx","Not Valid","1:20","Exception","Business Exception","Template does not contain Sheetname "JE"","","","NA"

I have created .conf file with the following filter configurations:  
filter {

```
if [message] =~ /^Debit Amount/ {
	drop {}
}

csv{
	separator => ","

	columns => ["Debit_Amount", "Sender_Email", "Received_Time", "Email_Sent_Time", "Date", "BOTID", "Company_Number", "Doc_Type", "GL_Date", "Explanation", "Ledger_Type", "Currency", "Exchange_Rate", "Reversal", "JE_Type", "JE_Preparer_User_Email", "Company_Name", "Region", "Posting_Period", "SourceFolder", "Email_Subject", "JE_File_Name", "Is_Template_Valid", "Process_Time", "Status", "Exception_Type", "Exception_Details", "ScreenShotPath", "ScreenShot_Name", "Potential_Duplicate_Identified"]
	
	add_field => { "test_process_status" => "Tested"}		
}
if [test_process_status] == "Tested"{
            mutate {
                    add_field => {
                                    "log_status" => "Successful"
                    }
            }
    }

else if [test_process_status] != "Tested"{
            mutate {
                    add_field => { "log_status" => "Failure" }
					add_field => { "temp_message" => "Parse Failure" }
					copy => {"message" => "temp_message"}
					}

```

}

But at the end it is providing \_csvparsefailure especially for the type of logs as mentioned above which has one of the column data consisting of "" as special characters.  
I need help in splitting the values stored in message field and update the obtained results in the respective columns.  
I would acknowledge if any other method is effective for this issue.

Thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 14, 2020, 5:03am UTC](https://discuss.elastic.co/t/need-to-split-the-value-in-the-message/237217/2 "2020-07-14T05:03:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.