Error while parsing csv file using logstash

Hi

Below is the error ,

[WARN ] 2018-07-25 11:26:36.878 [Ruby-0-Thread-6@[main]>worker0: :1] csv - Error parsing csv {:field=>"message", :source=>"\"Siemens AG\",\"INC1358413\",\"OATWIEN_5023\",\"\",\"Closed\",\"4-Planning (SEV 5)\",\"2018-06-21 15:26:05\",\"siemens.cic.now\",\"2018-06-21 15:29:00\",\"Customer\",\"TECHNICAL SUPPORT\",\"Other\",\"2018-06-25 15:55:10\",\"\",\"0\",\"175\",\"ISD - URA 2.0 Connectivity Issue: Die URA 2.0 Verbindung ist nicht m\xF6glich. / No URA connection possible via home WLAN a\",\"16895148\",\"INC4253004\",\"2018-06-25 15:55:12\",\"fatmasalem.salemabdelaziz\",\"2018-06-21 15:26:05\",\"2018-06-21 15:26:05\",\"siemens CIC to NOW\",\"\",\"\",\"false\",\"0\",\"Inquiry / Help\",\"\",\"175\",\"false\",\"true\",\"0\",\"false\",\"0\"", :exception=>#<CSV::MalformedCSVError: Illegal quoting in line 1.>}
[WARN ] 2018-07-25 11:26:37.908 [Ruby-0-Thread-6@[main]>worker0: :1] csv - Error parsing csv {:field=>"message", :source=>"\"CARL ZEISS AG\",\"INC1336871\",\"DEAAL10\",\"\",\"Closed\",\"3-Low (SEV 3)\",\"2018-05-29 13:18:23\",\"cic.cz.now\",\"2018-06-25 23:54:00\",\"Customer\",\"OTHER\",\"Other\",\"2018-06-25 22:00:34\",\"FORCE CLOSE\",\"0\",\"2,370,937\",\"Keine Anmeldungsm\xF6glichkeit\",\"16832413\",\"INC0636377\",\"2018-06-25 23:54:34\",\"cic.clarify.now\",\"2018-05-29 13:18:23\",\"2018-05-29 13:18:23\",\"CIC Zeiss Now\",\"Network Security\",\"\",\"false\",\"0\",\"Inquiry / Help\",\"Closed/Resolved by Caller\",\"2370937\",\"true\",\"true\",\"5\",\"false\",\"0\"", :exception=>#<CSV::MalformedCSVError: Illegal quoting in line 1.>}

Below is the logstash conf file

input{
file{
path => "/home/santra/Incidents_V2-2018-06-26_02_45_01.csv"
start_position => "beginning"
sincedb_path => "/dev/null"
}
}
filter{
csv{
separator => ","
columns => ["company","number","cmdb_ci","cmdb_ci_u_service","incident_state","priority","sys_created_on","sys_created_by","u_cleared","u_clear_code_u_responsible_party","u_clear_code","u_clear_code_u_specific","closed_at","u_close_code","business_stc","calendar_stc","short_description","u_clarify_case_id","u_customer_fault_no","sys_updated_on","sys_updated_by","u_actual_fault_time","opened_at","opened_by","u_business_services_ref_u_business_service_name","cmdb_ci_u_customer_device_name","active","business_duration","category","close_code","calendar_duration","u_flapping","made_sla","reopen_count","u_site_level","time_worked"]
}
}
output {
elasticsearch {
hosts => "http://127.0.0.1:9200"
}
}

Below is the sample CSV file

"Siemens AG","INC1360290","","","Closed","4-Planning (SEV 5)","2018-06-25 00:01:32","siemens.cic.now","2018-06-25 00:13:00","Customer","CANCELLED FAULT REPORT","Customer Requested","2018-06-25 00:01:32","","0","688","Unable to open the site after connect URA 2.0 - INC3811872","16902161","INC4002983","2018-06-25 00:15:02","cic.clarify.now","2018-06-25 00:01:32","2018-06-25 00:01:32","siemens CIC to NOW","","","false","0","Inquiry / Help","","688","false","true","0","false","0"
"VISA","INC1360289","PWIL044","IPVPN","Closed","2-Moderate (SEV 2)","2018-06-25 00:00:36","Proactive","2018-06-25 02:24:00","Orange","NETWORK ROUTING & CONFIG","Other","2018-06-25 02:24:39","FORCE CLOSE","8,604","8,604","PWIL044 - Fault - pwil044 with IP Address 10.227.29.61 is Down","16902160","","2018-06-25 02:24:40","cic.clarify.now","2018-06-25 00:00:00","2018-06-25 00:00:36","Proactive","","","false","8604","Inquiry / Help","","8604","false","true","0","false","0"
"Siemens AG","INC1360288","OINCOIMB4704","","Closed","4-Planning (SEV 5)","2018-06-25 00:00:30","siemens.cic.now","2018-06-25 00:07:00","Orange","NO FAULT FOUND","Polling Failure","2018-06-25 00:00:30","FORCE CLOSE","0","390","PCJB040 - - ALARM DETECTED IN SUPERVISI","16902159","INC4225108","2018-06-25 00:08:49","cic.clarify.now","2018-06-25 00:00:30","2018-06-25 00:00:30","siemens CIC to NOW","","","false","0","Inquiry / Help","","390","false","true","0","false","0"
"VISA","INC1360287","PMRU134","IPVPN","Closed","2-Moderate (SEV 2)","2018-06-25 00:00:06","Proactive","2018-06-25 02:22:00","Orange","NETWORK ROUTING & CONFIG","Other","2018-06-25 02:23:15","FORCE CLOSE","8,514","8,514","PMRU134 - Fault - pmru134 with IP Address 10.227.37.125 is Down","16902157","","2018-06-25 02:23:19","cic.clarify.now","2018-06-24 23:59:00","2018-06-25 00:00:06","Proactive","","","false","8514","Inquiry / Help","","8514","false","true","0","false","0"
"AP Moller Maersk","INC1360286","PKUL1733","IPVPN","Closed","2-Moderate (SEV 2)","2018-06-25 00:00:03","Proactive","2018-06-25 03:21:00","Customer","NETWORK ROUTING & CONFIG","Other","2018-06-25 03:22:31","FORCE CLOSE","12,057","12,057","PKUL1733 - Fault - IP SLA Operation Type HTTP named PKUL1733 -> Tun81 Zscaler HTTP Internet on node pkul1733 is Up. Message is","16902158","","2018-06-25 03:22:40","cic.clarify.now","2018-06-25 00:00:03","2018-06-25 00:00:03","Proactive","","PKUL1733","false","12057","Inquiry / Help","","12057","true","true","1","false","0"
"AkzoNobel_PPC","INC1360285","PCEG215","Business VPN Corporate","Closed","1-High (SEV 1)","2018-06-24 23:57:00","Proactive","2018-06-25 04:04:00","Orange","NO FAULT FOUND","Cleared Before Testing","2018-06-25 04:06:20","FORCE CLOSE","0","14,820","PCEG215 - Fault - Node pceg215 with IP Address 10.246.171.221 is Down","16902153","","2018-06-25 04:06:24","cic.clarify.now","2018-06-24 23:56:00","2018-06-24 23:57:00","Proactive","","PCEG215","false","0","Inquiry / Help","","14820","false","true","0","false","0"

Wanted help to understand the what is causing such error

That filter successfully parses all the examples for me (running 6.3.1). I do not see any quoting issue in the line it is complaining about.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.