# CSV not parsing logs **URL:** \ **Category:** Logstash\ **Created:** [June 12, 2018, 10:07pm UTC](https://discuss.elastic.co/t/csv-not-parsing-logs/135605 "2018-06-12T22:07:05Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![jkevan](https://avatars.discourse-cdn.com/v4/letter/j/839c29/32.png) [@jkevan](https://discuss.elastic.co/u/jkevan)\ **Post date:** [June 12, 2018, 10:07pm UTC](https://discuss.elastic.co/t/csv-not-parsing-logs/135605/1 "2018-06-12T22:07:05Z")
Hi there, I'm new to the elastic stack, so please forgive me if i ask some obvious questions. I currently have logstash collecting logs from our palo alto firewall and im not able to see any new fields pop up from the filters i have in place. here is the filter: > these are the only fields in Kibana: ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/9/a90f0367968ee16eff116cd1ce058f1fa73b88bf.png) ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [June 12, 2018, 11:46pm UTC](https://discuss.elastic.co/t/csv-not-parsing-logs/135605/2 "2018-06-12T23:46:16Z")
Please add ``` output { stdout { codec => rubydebug } } ``` and show us what one event looks like, with data sanitized according to your needs. We cannot see which tags were added, so we cannot tell which conditions were satisfied. Is the csv filter executing? Is it failing? We cannot tell until we see the whole event. Alternatively, instead of posting an image of the Table tab, you could copy text from the JSON tab and post that with triple backtick before and after. ```` ``` JSON goes here ``` ```` ---
**Author:** ![jkevan](https://avatars.discourse-cdn.com/v4/letter/j/839c29/32.png) [@jkevan](https://discuss.elastic.co/u/jkevan)\ **Post date:** [June 13, 2018, 3:10pm UTC](https://discuss.elastic.co/t/csv-not-parsing-logs/135605/3 "2018-06-13T15:10:05Z")
Thank you for the reply Badger! Sorry for my late response here is an event: ```auto { "_index": "network-2018.06.13", "_type": "doc", "_id": "f9eu-WMBqWuAu2Ip5NEe", "_version": 1, "_score": null, "_source": { "port": 43810, "type": "syslog", "raw_message": "1,2018/06/13 08:06:18,serialnum,SYSTEM,dhcp,0,2018/06/13 08:06:17,,lease-start,,0,0,general,informational,\"DHCP lease started ip 10.xxx.xxx.xxx --> mac - hostname iPhone, interface ethernet1/5\",6984574,0x8000000000000000,0,0,0,0,,PALOALTO", "message": "<14>Jun 13 08:06:18 Panorama 1,2018/06/13 08:06:18,serialnum,SYSTEM,dhcp,0,2018/06/13 08:06:17,,lease-start,,0,0,general,informational,\"DHCP lease started ip 10.xxx.xxx.xxx --> mac - hostname iPhone, interface ethernet1/5\",6984574,0x8000000000000000,0,0,0,0,,PALOALTO", "@version": "1", "syslog_pri": "14", "host": "Panorama", "role": "api-hello-app", "tags": [ "netsyslog", "SYSTEM" ], "hostname": "Panorama", "@timestamp": "2018-06-13T15:06:18.422Z" }, "fields": { "@timestamp": [ "2018-06-13T15:06:18.422Z" ] }, "sort": [ 1528902378422 ] } ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [June 13, 2018, 3:30pm UTC](https://discuss.elastic.co/t/csv-not-parsing-logs/135605/4 "2018-06-13T15:30:08Z")
Panorama does not match your hostname regex. Also where you have 'if [tag] == "SYSTEM"' that should be 'if "SYSTEM" in [tags]'. The csv filter works just fine. ---
**Author:** ![jkevan](https://avatars.discourse-cdn.com/v4/letter/j/839c29/32.png) [@jkevan](https://discuss.elastic.co/u/jkevan)\ **Post date:** [June 13, 2018, 3:37pm UTC](https://discuss.elastic.co/t/csv-not-parsing-logs/135605/5 "2018-06-13T15:37:06Z")
Panorama is the sanitized hostname. its more like "Panorama-100\_som\_letters\_b12-sw.domain" so maybe im misunderstanding, csv doesnt break out the values in "raw\_message" into more available fields? or do i need to write a separate grok for that? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [June 13, 2018, 3:41pm UTC](https://discuss.elastic.co/t/csv-not-parsing-logs/135605/6 "2018-06-13T15:41:27Z")
If I take that message, change Panorama to Panorama-100\_som\_letters\_b12-sw.domain, _and_ make the changes to the check for [tags] then csv splits out the fields. This is truncated, but shows some of the fields... ```auto "Description" => "DHCP lease started ip 10.xxx.xxx.xxx --> mac - hostname iPhone, interface ethernet1/5", "dg_hier_level_2" => "0", "@timestamp" => 2018-06-13T15:39:27.526Z, "Log-Level" => "0", "ReceiveTime" => "2018/06/13 08:06:18", "dg_hier_level_3" => "0", "Severity" => "informational", "FUTURE_USE" => "1", "LogNumber" => "6984574", "Type" => "SYSTEM", "Object" => nil, "hostname" => "Panorama-100_som_letters_b12-sw.domain", "dg_hier_level_1" => "0", "type" => "syslog", "syslog_pri" => "14", ``` ---
**Author:** ![jkevan](https://avatars.discourse-cdn.com/v4/letter/j/839c29/32.png) [@jkevan](https://discuss.elastic.co/u/jkevan)\ **Post date:** [June 13, 2018, 3:43pm UTC](https://discuss.elastic.co/t/csv-not-parsing-logs/135605/7 "2018-06-13T15:43:51Z")
Ahhh i see it was the 'if "SYSTEM" in tags'. THANK YOU! you're awesome ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 11, 2018, 3:58pm UTC](https://discuss.elastic.co/t/csv-not-parsing-logs/135605/8 "2018-07-11T15:58:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.