# Substring of column
**URL:** https://discuss.elastic.co/t/substring-of-column/189121
**Category:** Logstash
**Created:** [July 5, 2019, 2:13pm UTC](https://discuss.elastic.co/t/substring-of-column/189121 "2019-07-05T14:13:57Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@Syed.Ubaid](https://discuss.elastic.co/u/Syed.Ubaid)
#### Post date: [July 5, 2019, 2:13pm UTC](https://discuss.elastic.co/t/substring-of-column/189121/1 "2019-07-05T14:13:58Z")
Need to add a new column with substring/extracted value of available column.
Example:
Your XYZ Debit Card has been charged $ xxxxx.xx
I need to add columns
cardtype =\> Debit/Credit
Amount =\> xxxxx.xx
would great if any one help me out for conf file setting
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 5, 2019, 3:45pm UTC](https://discuss.elastic.co/t/substring-of-column/189121/2 "2019-07-05T15:45:45Z")
Use grok
```
grok {
match => { "message" => ["%{WORD:cardType} Card", "\$ %{NUMBER:amount:float}"] }
break_on_match => false
}
```
---
### Author:  [@Syed.Ubaid](https://discuss.elastic.co/u/Syed.Ubaid)
#### Post date: [July 8, 2019, 5:57am UTC](https://discuss.elastic.co/t/substring-of-column/189121/3 "2019-07-08T05:57:12Z")
I need two add two columns that is cardtype and amount for example
23xxxxxxxxx,Mobilink,6222,Your MCB Debit Card has been charged PKR xx
Your MCB Debit Card has been charged for PKR this add to one column cardtype
PKR xxxx goes to another column which is Amount
Result would be like this
Message : 23xxxxxxxxx,Mobilink,6222,Your MCB Debit Card has been charged PKR xx
Cardtype : **Debit** which match from the message which card type is
Amount : **xxxxxx**
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 8, 2019, 1:36pm UTC](https://discuss.elastic.co/t/substring-of-column/189121/4 "2019-07-08T13:36:38Z")
> [@Syed.Ubaid](#):
>
> Message : 23xxxxxxxxx,Mobilink,6222,Your MCB Debit Card has been charged PKR xx
> Cardtype : **Debit** which match from the message which card type is
> Amount : **xxxxxx**
Do you expect xxxxxx to match xx or a substring of xxxxxxxxx?
---
### Author:  [@Syed.Ubaid](https://discuss.elastic.co/u/Syed.Ubaid)
#### Post date: [July 9, 2019, 4:32am UTC](https://discuss.elastic.co/t/substring-of-column/189121/5 "2019-07-09T04:32:10Z")
xxxxxxx to match with PKR XX
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 9, 2019, 1:52pm UTC](https://discuss.elastic.co/t/substring-of-column/189121/6 "2019-07-09T13:52:05Z")
OK, so in the grok pattern I wrote replace \$ with PKR, or change it to (\$|PKR) if you want it to match either.
---
### Author:  [@Syed.Ubaid](https://discuss.elastic.co/u/Syed.Ubaid)
#### Post date: [July 9, 2019, 3:33pm UTC](https://discuss.elastic.co/t/substring-of-column/189121/7 "2019-07-09T15:33:32Z")
can you write the full command it will be help full
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 9, 2019, 3:43pm UTC](https://discuss.elastic.co/t/substring-of-column/189121/8 "2019-07-09T15:43:09Z")
```
match => { "message" => ["%{WORD:cardType} Card", "(\$|PKR) %{NUMBER:amount:float}"] }
```
---
### Author:  [@Syed.Ubaid](https://discuss.elastic.co/u/Syed.Ubaid)
#### Post date: [July 9, 2019, 4:53pm UTC](https://discuss.elastic.co/t/substring-of-column/189121/9 "2019-07-09T16:53:23Z")
Thanks a ton !!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 6, 2019, 4:53pm UTC](https://discuss.elastic.co/t/substring-of-column/189121/10 "2019-08-06T16:53:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.