# CSV: autodetect\_column\_names vs. autogenerate\_column\_names

**URL:** <https://discuss.elastic.co/t/csv-autodetect-column-names-vs-autogenerate-column-names/164182>\
**Category:** Logstash\
**Created:** [January 14, 2019, 5:56pm UTC](https://discuss.elastic.co/t/csv-autodetect-column-names-vs-autogenerate-column-names/164182 "2019-01-14T17:56:47Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aralex](https://avatars.discourse-cdn.com/v4/letter/a/e56c9b/32.png) [@Aralex](https://discuss.elastic.co/u/Aralex)\
**Post date:** [January 14, 2019, 5:56pm UTC](https://discuss.elastic.co/t/csv-autodetect-column-names-vs-autogenerate-column-names/164182/1 "2019-01-14T17:56:48Z")

</div>

Hi,

1. What are the exact functional differences between autodetect\_column\_names and autogenerate\_column\_names in the csv filter?

2. Is it bad/good using both (set to true)?

3. IS there a recommended order for using both simultaneously?

Neither seem to be working as expected in my case (just a standard csv filled with basic info).

Since we're on this:  
4) In my case, Filebeat sends the csv data to Logstash. What are the detailed operational differences if I start Filebeat before Logstash and vice versa?

Thanks.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 14, 2019, 7:07pm UTC](https://discuss.elastic.co/t/csv-autodetect-column-names-vs-autogenerate-column-names/164182/2 "2019-01-14T19:07:32Z")

</div>

If autogenerate\_column\_names is enabled, it will create its own names for columns where no name is supplied. For example, if we have a csv with two field and we parse it with

```
     autogenerate_column_names => false
     columns => ["Foo"]

```

then the events will only have data from the first column, which will be in a field called Foo. If we parse it with

```
     autogenerate_column_names => true
     columns => ["Foo"]

```

then the events will have two fields of data. One call Foo and one called column2.

For autodetect ... suppose we have a file that contains

```
foo,BAR,baz
1,2,3

```

If we parse that using

```
csv {
     autodetect_column_names => true
}

```

We will get a _single event_ that has these fields in it

```
       "foo" => "1",
       "baz" => "3",
       "BAR" => "2"

```

It detects the column name by consuming the header line.

Setting both to true might be useful if you were consuming a file that had an incomplete header line, like this

```
foo,BAR
1,2,3
```

---

<div class="post-metadata">

**Author:** ![Aralex](https://avatars.discourse-cdn.com/v4/letter/a/e56c9b/32.png) [@Aralex](https://discuss.elastic.co/u/Aralex)\
**Post date:** [January 15, 2019, 9:13am UTC](https://discuss.elastic.co/t/csv-autodetect-column-names-vs-autogenerate-column-names/164182/3 "2019-01-15T09:13:03Z")

</div>

This is incredibly helpful, thank you so much Badger. This could also explain why I've been getting the same data parsed twice, I had strong suspicions with these two settings but wasn't sure of their exact difference.  
Thanks again.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 12, 2019, 9:13am UTC](https://discuss.elastic.co/t/csv-autodetect-column-names-vs-autogenerate-column-names/164182/4 "2019-02-12T09:13:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.