# CSV output has been broken since 5.0

**URL:** https://discuss.elastic.co/t/csv-output-has-been-broken-since-5-0/77188
**Category:** Logstash
**Created:** [March 2, 2017, 5:05pm UTC](https://discuss.elastic.co/t/csv-output-has-been-broken-since-5-0/77188 "2017-03-02T17:05:50Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![j2man](https://avatars.discourse-cdn.com/v4/letter/j/e480ec/32.png) [@j2man](https://discuss.elastic.co/u/j2man)
#### Post date: [March 2, 2017, 5:05pm UTC](https://discuss.elastic.co/t/csv-output-has-been-broken-since-5-0/77188/1 "2017-03-02T17:05:50Z")

</div>

We need to stop letting this fall off due to inactivity.

> [@Export from elasticsearch to csv problem. Where I am wrong?](https://discuss.elastic.co/t/export-from-elasticsearch-to-csv-problem-where-i-am-wrong/65558):
>
> Hi have the following logstash config file: input { elasticsearch { hosts =\> ["localhost"] index =\> "myindex" type =\> "mytype" query =\> '{"query" : { "match\_all" : {} }}' } } output { csv { fields =\> [my\_fields\_array] path =\> "export.csv csv\_options =\> {"col\_sep" =\> "\t" "row\_sep" =\> "\r\n"} } } Opening export.csv i don't get any mapped data fields but only a list of something like: 2016-11-02T07:41:15.917Z %{host} %{message}2016-11-02T07:41:16.708Z %{host}... Any idea about …

Also bug report has been generated here:

> <https://github.com/logstash-plugins/logstash-output-csv/issues/14>
>
> Seems that 5.2 broke the CSV output plugin. 
> 
> This will generate a "csv" with …all the message fields all the time NOT separated by comma's but spaces even though "blah" does not exist as a field. This works correctly in 2.3 and is broken in 5.2.
> 
> To recreate pass in a file with this in it:
> 00:00:00.0 COMM\_TURNED\_ON YODA
> 
> Use this grok pattern:
> EVENT\_COMM\_TURNED\_ON %{TIME:event\_time}%{SPACE}%{NOTSPACE:event\_type}%{SPACE}%{NOTSPACE:name}
> 
> input { stdin { } }
> filter {
> grok {
> patterns\_dir =\>\["C:/src/elk/broken"\]
> match =\>\["message", "%{EVENT\_COMM\_TURNED\_ON}"\]
> }
> }
> 
> output {
> if "\_grokparsefailure" not in \[tags\] {
> elasticsearch {
> index =\> "raw-data-%{+YYYY.MM.dd}"
> }
> if "COMM\_TURNED\_ON" in \[message\] {
> csv {
> fields =\> \["blah"\]
> csv\_options =\> {"col\_sep" =\> "," "row\_sep" =\> "\\r\\n"}
> path =\> "C:/src/elk/comm\_turned\_on.csv"
> }
> }
> }
> }

-j

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [March 19, 2017, 5:25am UTC](https://discuss.elastic.co/t/csv-output-has-been-broken-since-5-0/77188/2 "2017-03-19T05:25:26Z")

</div>

Looks like this has been sorted in that GH issue 🙂

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 16, 2017, 5:25am UTC](https://discuss.elastic.co/t/csv-output-has-been-broken-since-5-0/77188/3 "2017-04-16T05:25:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
