# Can FileBeat parse csv file and send the data in fields to elastic search directly?

**URL:** <https://discuss.elastic.co/t/can-filebeat-parse-csv-file-and-send-the-data-in-fields-to-elastic-search-directly/68507>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [December 9, 2016, 4:05am UTC](https://discuss.elastic.co/t/can-filebeat-parse-csv-file-and-send-the-data-in-fields-to-elastic-search-directly/68507 "2016-12-09T04:05:48Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![dnafication](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dnafication/32/13764_2.png) [@dnafication](https://discuss.elastic.co/u/dnafication)\
**Post date:** [December 9, 2016, 4:05am UTC](https://discuss.elastic.co/t/can-filebeat-parse-csv-file-and-send-the-data-in-fields-to-elastic-search-directly/68507/1 "2016-12-09T04:05:48Z")

</div>

I am listening to a log file (which is a CSV file) using FileBeat and sending the data to elasticsearch instance. I am using the default configurations for FileBeat as well as elasticsearch. It works but my data is shown in elastic in a field called `message`.  
e.g.

```
"input_type": "log",
"message": "1481250458524,263,dummy request 3,200,OK,Thread Group 2 2-2,text,true,,114,0,10,15,39,0,2",
"offset": 143092,

```

How can I make it process message into different fields before sending it to elastic?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [December 9, 2016, 4:56am UTC](https://discuss.elastic.co/t/can-filebeat-parse-csv-file-and-send-the-data-in-fields-to-elastic-search-directly/68507/2 "2016-12-09T04:56:14Z")

</div>

Filebeat is designed to be light-weight, and therefore supports limited parsing. I do not believe parsing of CSV event is currently supported in Filebeat, but you can do this by sending the data to either Logstash or an Elasticsearch ingest node.

---

<div class="post-metadata">

**Author:** ![dnafication](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dnafication/32/13764_2.png) [@dnafication](https://discuss.elastic.co/u/dnafication)\
**Post date:** [December 9, 2016, 5:19am UTC](https://discuss.elastic.co/t/can-filebeat-parse-csv-file-and-send-the-data-in-fields-to-elastic-search-directly/68507/3 "2016-12-09T05:19:25Z")

</div>

Thanks, I'll try the elasticsearch ingest node. Do you have any guide on that?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [December 9, 2016, 7:20am UTC](https://discuss.elastic.co/t/can-filebeat-parse-csv-file-and-send-the-data-in-fields-to-elastic-search-directly/68507/4 "2016-12-09T07:20:54Z")

</div>

The documentation is available here: [https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html)

You can also look at the following blog posts:

> **[A New Way To Ingest - Part 1](https://www.elastic.co/blog/new-way-to-ingest-part-1)**
>
> Elasticsearch 5 allows changing data right before indexing it, for example extracting fields or looking up IP addresses.

> **[A New Way To Ingest - Part 2](https://www.elastic.co/blog/new-way-to-ingest-part-2)**
>
> Ingest Nodes in the Elastic Stack 5 allow indexing data directly from Filebeat and Winlogbeat into Elasticsearch and visualizing it with Kibana.

---

<div class="post-metadata">

**Author:** ![dnafication](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dnafication/32/13764_2.png) [@dnafication](https://discuss.elastic.co/u/dnafication)\
**Post date:** [December 9, 2016, 8:37am UTC](https://discuss.elastic.co/t/can-filebeat-parse-csv-file-and-send-the-data-in-fields-to-elastic-search-directly/68507/5 "2016-12-09T08:37:32Z")

</div>

Thanks Christian. I'll try that out.

Best regards,  
Dina.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 6, 2017, 8:37am UTC](https://discuss.elastic.co/t/can-filebeat-parse-csv-file-and-send-the-data-in-fields-to-elastic-search-directly/68507/6 "2017-01-06T08:37:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.