# Parsing with hyphens **URL:** \ **Category:** Logstash\ **Created:** [August 7, 2016, 12:57pm UTC](https://discuss.elastic.co/t/parsing-with-hyphens/57421 "2016-08-07T12:57:54Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![bastianhoss](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bastianhoss/32/11437_2.png) [@bastianhoss](https://discuss.elastic.co/u/bastianhoss)\ **Post date:** [August 7, 2016, 12:57pm UTC](https://discuss.elastic.co/t/parsing-with-hyphens/57421/1 "2016-08-07T12:57:54Z")
Hey there, I'm looking for an opportunity to parse this expression: TEST\_test\_123-NONE-testTEST123-Test\_123 into TEST\_test\_123, NONE, testTEST123, Test\_123 I've tried to use custom patterns like : [a-zA-Z0-9\_] , [/w+-] \<- Dosen't work. Anytime a \_grokparefailure Thank you for supporting me. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [August 7, 2016, 2:12pm UTC](https://discuss.elastic.co/t/parsing-with-hyphens/57421/2 "2016-08-07T14:12:34Z")
What are you looking to parse it into? ---
**Author:** ![bastianhoss](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bastianhoss/32/11437_2.png) [@bastianhoss](https://discuss.elastic.co/u/bastianhoss)\ **Post date:** [August 7, 2016, 3:13pm UTC](https://discuss.elastic.co/t/parsing-with-hyphens/57421/3 "2016-08-07T15:13:18Z")
Into: [quote="bastianhoss, post:1, topic:57421"] TEST\_test\_123, NONE, testTEST123, Test\_123 [/quote] ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [August 7, 2016, 3:17pm UTC](https://discuss.elastic.co/t/parsing-with-hyphens/57421/4 "2016-08-07T15:17:31Z")
You could have a look at the csv filter and use this with `'-'` as a separator. ---
**Author:** ![bastianhoss](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bastianhoss/32/11437_2.png) [@bastianhoss](https://discuss.elastic.co/u/bastianhoss)\ **Post date:** [August 7, 2016, 4:04pm UTC](https://discuss.elastic.co/t/parsing-with-hyphens/57421/5 "2016-08-07T16:04:25Z")
Csv filter? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [August 7, 2016, 4:37pm UTC](https://discuss.elastic.co/t/parsing-with-hyphens/57421/6 "2016-08-07T16:37:19Z")
I may have misunderstood. Do you want to parse out 4 fields or reformat the string? ---
**Author:** ![bastianhoss](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bastianhoss/32/11437_2.png) [@bastianhoss](https://discuss.elastic.co/u/bastianhoss)\ **Post date:** [August 7, 2016, 4:53pm UTC](https://discuss.elastic.co/t/parsing-with-hyphens/57421/7 "2016-08-07T16:53:04Z")
4 different string fields ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [August 7, 2016, 5:00pm UTC](https://discuss.elastic.co/t/parsing-with-hyphens/57421/8 "2016-08-07T17:00:44Z")
You can probably do it with grok, but it is just as easy with the [csv filter plugin](https://www.elastic.co/guide/en/logstash/current/plugins-filters-csv.html). If the string provided is your full message, something like this should work: ``` csv { columns => ["field1","field2","field3","field4"] separator => "-" } ``` ---
**Author:** ![bastianhoss](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bastianhoss/32/11437_2.png) [@bastianhoss](https://discuss.elastic.co/u/bastianhoss)\ **Post date:** [August 7, 2016, 5:58pm UTC](https://discuss.elastic.co/t/parsing-with-hyphens/57421/9 "2016-08-07T17:58:18Z")
TEST\_test\_123-NONE-testTEST123-Test\_123 Is par of a syslog entry. Is it possible to format the above mentioned stirng with grok and later ist the filter with csv ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 10, 2016, 5:52am UTC](https://discuss.elastic.co/t/parsing-with-hyphens/57421/10 "2016-08-10T05:52:39Z")
> Is it possible to format the above mentioned stirng with grok and later ist the filter with csv Yes, you can use grok to extract the string from the syslog message and then apply the csv filter to that string. ---
**Author:** ![bastianhoss](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bastianhoss/32/11437_2.png) [@bastianhoss](https://discuss.elastic.co/u/bastianhoss)\ **Post date:** [August 17, 2016, 7:29am UTC](https://discuss.elastic.co/t/parsing-with-hyphens/57421/11 "2016-08-17T07:29:26Z")
Hi, using own pattern brings the solution: NOT\_HYPHEN [^-]+ ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:43am UTC](https://discuss.elastic.co/t/parsing-with-hyphens/57421/12 "2017-07-06T04:43:08Z")