# Parsing text file with specific fields

**URL:** <https://discuss.elastic.co/t/parsing-text-file-with-specific-fields/76256>\
**Category:** Logstash\
**Created:** [February 23, 2017, 3:29pm UTC](https://discuss.elastic.co/t/parsing-text-file-with-specific-fields/76256 "2017-02-23T15:29:30Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![SebB](https://avatars.discourse-cdn.com/v4/letter/s/13edae/32.png) [@SebB](https://discuss.elastic.co/u/SebB)\
**Post date:** [February 23, 2017, 3:29pm UTC](https://discuss.elastic.co/t/parsing-text-file-with-specific-fields/76256/1 "2017-02-23T15:29:31Z")

</div>

Hi.

I want to parse a csv file that's look like this:  
EventId : 212, Level : Informational, Message : Receiver RetoursStatutVcom last executed on 20170223-000407, duration 5257 ms, Payload : [name : RetoursStatutVcom] [lastExecution : 20170223-000407] [lastDurationinMs : 5257] , EventName : TraceAliveInfo, Timestamp : 2017-02-22T23:04:11.0065190Z, ProcessId : 7484, ThreadId : 10696

Each field contain name and value.  
I saw that it could be done with csv filter but how can I drop field name ?  
-\> EventId : 212 should become 212

Any ideas?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 27, 2017, 6:43am UTC](https://discuss.elastic.co/t/parsing-text-file-with-specific-fields/76256/2 "2017-02-27T06:43:00Z")

</div>

I suggest you instead use the kv filter.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 27, 2017, 6:43am UTC](https://discuss.elastic.co/t/parsing-text-file-with-specific-fields/76256/3 "2017-03-27T06:43:05Z")

</div>

Closed on March 27, 2017, 6:43am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.