Add Column in csv file logstash

Elastic Stack Logstash
1

hello everyone , please i need ur help
i want add new columns in my logstash config file but i don't how do it ??
there is my config file :
input {
file {
path => "C:\elk\logstash\data.csv"
start_position => "beginning"
sincedb_path => "/dev/null"
}
}
filter {
csv {
separator => ","
columns => ["maker","model","mileage","manufacture_year","engine_displacement","engine_power","body_type","color_slug","stock_year", "transmission","door_count","seat_count","fuel_type","date_created","date_last_seen","price_euro",]
add_tag => [ "country" ]
if [maker]=='ford'{[country]== 'USA'}
if [maker]=='skoda'{[country]== 'Czech Republic'}
if [maker]=='audi'{[country]== 'germany'}
}

}
output {
elasticsearch {
hosts => "http://localhost:9200"
index => "database"
}
stdout {}
}

2

Remove the add_tag. You could do this with a series of

if [maker]=='ford' { mutate { add_field => { "country" => 'USA' } } }

Or with one translate filter. In either case these would come after the csv filter, not inside it.

  translate {
    field => "maker"
    destination => "country"
    dictionary => [
      'ford', 'USA',
      'skoda', 'Czech Republic',
      'audi', 'germany'
    ]
  }

If your input varies in case then use a temporary field

  mutate { add_field => { "[@metadata][lowermaker]" => "%{maker}" } }
  mutate { lowercase => [ "[@metadata][lowermaker]" ] }
  translate {
    field => "[@metadata][lowermaker]"
    [...]
2 Likes
3

path => "C:\elk\logstash\data.csv"
start_position => "beginning"
sincedb_path => "/dev/null"

On Windows use "nul" instead of "/dev/null".

1 Like
4

thank you very much Mr Magnus :souriant:

5

Thank you very much Badger :smiley:

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.