# ElasticSearch/Logstash input to CSV output mapping question

**URL:** <https://discuss.elastic.co/t/elasticsearch-logstash-input-to-csv-output-mapping-question/65837>\
**Category:** Logstash\
**Created:** [November 11, 2016, 7:02pm UTC](https://discuss.elastic.co/t/elasticsearch-logstash-input-to-csv-output-mapping-question/65837 "2016-11-11T19:02:56Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Thermocatalyst](https://avatars.discourse-cdn.com/v4/letter/t/2acd7d/32.png) [@Thermocatalyst](https://discuss.elastic.co/u/Thermocatalyst)\
**Post date:** [November 11, 2016, 7:02pm UTC](https://discuss.elastic.co/t/elasticsearch-logstash-input-to-csv-output-mapping-question/65837/1 "2016-11-11T19:02:56Z")

</div>

I'm attempting to read JSON data from ES and convert it to a CSV file, but I'm getting an unexpected result.

I'd like to take selected fields from the JSON document, and add write them to a CSV.

Here's my configuration file for Logstash...

```
input {
  elasticsearch {
    hosts => ["server:port"]
    size => "100"
    index => "tibcostats-*"
    scroll => "1m"
    docinfo => true
  }
}

filter {
        json {
                source => "message"
        }
}

output {
        csv {
                path => "/Users/jonathan.shelley/Downloads/test1.csv"
                fields => ["inputtype","[message][TibcoStat][Activity][ExecutionCount]"]
        }
        stdout { codec => rubydebug }
}

```

A sample JSON document that's being received from ES...  
{  
"environment" =\> "perf",  
"@timestamp" =\> 2016-11-06T00:55:02.310Z,  
"messagetype" =\> "tibcostats",  
"@version" =\> "1",  
"inputtype" =\> "jms",  
"TibcoStat" =\> {  
"Activity" =\> {  
"ExecutionCount" =\> 235  
}  
},  
"type" =\> "tibcostats"  
}

My CSV output from running this configuration leads to a repeated output of  
2016-11-07T08:24:25.543Z %{host} %{message}

Am I missing something obvious? Thanks in advance.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 16, 2016, 4:42am UTC](https://discuss.elastic.co/t/elasticsearch-logstash-input-to-csv-output-mapping-question/65837/2 "2016-11-16T04:42:45Z")

</div>

Are you running Logstash 5?

---

<div class="post-metadata">

**Author:** ![Thermocatalyst](https://avatars.discourse-cdn.com/v4/letter/t/2acd7d/32.png) [@Thermocatalyst](https://discuss.elastic.co/u/Thermocatalyst)\
**Post date:** [November 16, 2016, 5:17pm UTC](https://discuss.elastic.co/t/elasticsearch-logstash-input-to-csv-output-mapping-question/65837/3 "2016-11-16T17:17:02Z")

</div>

Yes, Logstash 5.0.0

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 17, 2016, 6:36am UTC](https://discuss.elastic.co/t/elasticsearch-logstash-input-to-csv-output-mapping-question/65837/4 "2016-11-17T06:36:10Z")

</div>

Known bug in 5.0's csv filter.

> <https://github.com/logstash-plugins/logstash-output-csv/issues/10>

---

<div class="post-metadata">

**Author:** ![Thermocatalyst](https://avatars.discourse-cdn.com/v4/letter/t/2acd7d/32.png) [@Thermocatalyst](https://discuss.elastic.co/u/Thermocatalyst)\
**Post date:** [November 17, 2016, 4:21pm UTC](https://discuss.elastic.co/t/elasticsearch-logstash-input-to-csv-output-mapping-question/65837/5 "2016-11-17T16:21:51Z")

</div>

Many thanks. Will keep an eye on the bug report.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 15, 2016, 4:21pm UTC](https://discuss.elastic.co/t/elasticsearch-logstash-input-to-csv-output-mapping-question/65837/6 "2016-12-15T16:21:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.