# simple csv event log parse **URL:** \ **Category:** DQL\ **Tags:** dql, log-processing, csv, dpl\ **Created:** [January 11, 2024, 2:47pm UTC](https://community.dynatrace.com/t/simple-csv-event-log-parse/43568 "2024-01-11T14:47:01Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![S\_Hadley1138](https://avatars.discourse-cdn.com/v4/letter/s/ed655f/32.png) [@S\_Hadley1138](https://community.dynatrace.com/u/S_Hadley1138)\ **Post date:** [January 11, 2024, 2:47pm UTC](https://community.dynatrace.com/t/simple-csv-event-log-parse/43568/1 "2024-01-11T14:47:01Z")
Hi there, I’m having a problem with a simple parser acting on a csv file. my problem appears when there is an empty field and a **“,”** in the source log. I’ve simplified the log below to attempt to easily demonstrate my issue. 2024-01-11T13:23:02.578Z,192.168.0.100,Server1,Test,Test,CatContentConversion 2024-01-11T13:24:06.345Z,192.168.0.103,Server2,Test,Test,Alert 2024-01-11T13:27:04.543Z,192.168.0.103,Server2,Test,Alert 2024-01-11T13:28:03.345Z,192.168.0.178,Server5,Tree,Bannana This is my Parse in DPL architect JSONTIMESTAMP:timestamp ‘,’ IPV4ADDR:field1 ‘,’ LD:field2 ‘,’ LD:field3 ‘,’ LD:field4 ‘,’ LD:field5 EOF the 3rd and 4th lines in the log, should have empty values in field3, as it is represented by **“,”** in the source. However, what i am finding is that this double comma, seems to corrupt in the parse, and it just skips those records all together. very odd behaviour. if you insert a character between the commas, it then works fine Does anyone else parse csv log files and have seen this issue before? Any pointers would be appreciated, thanks in advance ---
**Author:** ![sinisa\_zubic](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/sinisa_zubic/32/32498_2.png) [@sinisa\_zubic](https://community.dynatrace.com/u/sinisa_zubic)\ **Post date:** [January 11, 2024, 5:00pm UTC](https://community.dynatrace.com/t/simple-csv-event-log-parse/43568/2 "2024-01-11T17:00:02Z")
Hi [@S\_Hadley1138](https://community.dynatrace.com/user/70034) you can add an asterix to the fields which might not be populated ![sinisa_zubic_0-1704992385458.png](https://global.discourse-cdn.com/dynatrace/original/2X/3/34380ce1e55222a265330e42ed5bd3541708c109.png) ![sinisa_zubic_1-1704992395947.png](https://global.discourse-cdn.com/dynatrace/original/3X/5/a/5ac7fcdbf422ff17fb46e553ddddc44ecf592877.png) Best, Sini ---
**Author:** ![S\_Hadley1138](https://avatars.discourse-cdn.com/v4/letter/s/ed655f/32.png) [@S\_Hadley1138](https://community.dynatrace.com/u/S_Hadley1138)\ **Post date:** [January 12, 2024, 3:41pm UTC](https://community.dynatrace.com/t/simple-csv-event-log-parse/43568/3 "2024-01-12T15:41:11Z")
brilliant, thanks…  there is a follow-up question, as clearly you know your parsing…    if say **field4** potentially contains multiple entries, the are separated by a “ **;** ”  how do i extract these?  given that not all lines will have this? 2024-01-11T13:23:02.578Z,192.168.0.100,Server1,Test,Test;Cat;Dog,CatContentConversion 2024-01-11T13:24:06.345Z,192.168.0.103,Server2,Test,Test,Alert 2024-01-11T13:27:04.543Z,192.168.0.103,Server2,Test;elephant,Alert 2024-01-11T13:28:03.345Z,192.168.0.178,Server5,Tree,Bannana ---
**Author:** ![sinisa\_zubic](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/sinisa_zubic/32/32498_2.png) [@sinisa\_zubic](https://community.dynatrace.com/u/sinisa_zubic)\ **Post date:** [January 12, 2024, 4:00pm UTC](https://community.dynatrace.com/t/simple-csv-event-log-parse/43568/4 "2024-01-12T16:00:11Z")
you can do it with [alternative groups](https://docs.dynatrace.com/docs/shortlink/dpl-alternatives-group) ```markup JSONTIMESTAMP:timestamp ',' IPV4ADDR:field1 ',' LD*:field2 ',' LD*:field3 ',' ((LD:subfield1 ';' LD:subfield2 ';' LD:subfield3)|(LD:field4)) ',' LD:field5 ``` ![sinisa_zubic_0-1705075171605.png](https://global.discourse-cdn.com/dynatrace/original/3X/1/a/1a836579a8ecae99d903ff4a704e1044142aef13.png) ---
**Author:** ![S\_Hadley1138](https://avatars.discourse-cdn.com/v4/letter/s/ed655f/32.png) [@S\_Hadley1138](https://community.dynatrace.com/u/S_Hadley1138)\ **Post date:** [January 12, 2024, 4:13pm UTC](https://community.dynatrace.com/t/simple-csv-event-log-parse/43568/5 "2024-01-12T16:13:22Z")
thanks, not 100% sure i have understood it.  field 4 needs to be split into multiple sub fields.  not seeing that in the output.  _what if i dont know how many sub fields there might be?_ _(i owe you a beer/coffee/milkshake)_ ---
**Author:** ![sinisa\_zubic](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/sinisa_zubic/32/32498_2.png) [@sinisa\_zubic](https://community.dynatrace.com/u/sinisa_zubic)\ **Post date:** [January 15, 2024, 8:55am UTC](https://community.dynatrace.com/t/simple-csv-event-log-parse/43568/6 "2024-01-15T08:55:55Z")
if you don’t know how many sub fields there are, then the best is to match it as array ```markup JSONTIMESTAMP:timestamp ',' IPV4ADDR:field1 ',' LD*:field2 ',' LD*:field3 ',' (Array{LD:i (';' | >>',')}{1,}:field4)? ',' LD:field5 ``` ![sinisa_zubic_0-1705308914558.png](https://global.discourse-cdn.com/dynatrace/original/2X/3/3bca55a4c488aed9b1cc84615278d6af1343a20d.png)