CSV Filter in Logstash 2.2

Elastic Stack Logstash
1

I just upgraded from Logstash 1.7 to Logstash 2.2. most things are working except for my csv filters. I get XML data and some of the fields contain csv values. In Logstash 1.7 my filter looked like this:

csv {
source => ["Threat_Names"]
columns => ["Sig01_Name", "Sig02_Name", "Sig03_Name", "Sig04_Name", "Sig05_Name", "Sig06_Name", "Sig07_Name", "Sig08_Name", "Sig09_Name", "Sig10_Name"]
separator => ","
}

with the upgrade to Logstash I get errors in the logstash.log file that look like this

{:timestamp=>"2016-02-16T19:20:49.938000+0000", :message=>"Error parsing csv", :field=>"Threat_Names", :source=>["A211,B211,C211,G211,Ribo,1umBl,,,,"], :exception=>#<NoMethodError: private method `gets' called for ["A211,B211,C211,G211,Ribo,1umBl,,,,"]:Array>, :level=>:warn}

The xpath part is working because the values in the message are showing up in Threat_Names but its not parsing the contents of that field out into different fields.

2

Bumping up, any ideas

3

Is there a way to do a bounty on this error? I would really like it fixed.

For some reason the error I copied didn't show it, so here is the new error

{:timestamp=>"2016-03-09T23:20:21.457000+0000", :message=>"Error parsing csv", :field=>"Threat_Names", :source=>["A211,B211,C211K2,G211,Ov1RfB50A3-0,Bg-SK2,Ova-SK2,Eh-SK2,,"], :exception=>#<NoMethodError: private methodgets' called for ["A211,B211,C211K2,G211,Ov1RfB50A3-0,Bg-SK2,Ova-SK2,Eh-SK2,,"]:Array>, :level=>:warn}`

If there is any way to fix this please respond.

Thanks

4

Hello,
looking into your error report it seems that your field is an Array containing a string and not directly a string.
As you said it was working before, something else must have changed in the previous filters (xml?) causing this

Otherwise you must change your config to point to the string inside the array source => "[Threat_Names][0]"

5

Thank you so much, yes that worked. I'll look into the xml filter and see if things changed there. But for now I can work around and move my system to the latest. Thanks again