# Error while parsing csv file using logstash

**URL:** https://discuss.elastic.co/t/error-while-parsing-csv-file-using-logstash/141552
**Category:** Logstash
**Created:** [July 25, 2018, 11:42am UTC](https://discuss.elastic.co/t/error-while-parsing-csv-file-using-logstash/141552 "2018-07-25T11:42:58Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![jibinoosae](https://avatars.discourse-cdn.com/v4/letter/j/858c86/32.png) [@jibinoosae](https://discuss.elastic.co/u/jibinoosae)
#### Post date: [July 25, 2018, 11:42am UTC](https://discuss.elastic.co/t/error-while-parsing-csv-file-using-logstash/141552/1 "2018-07-25T11:42:58Z")

</div>

Hi

**Below is the error ,**

[WARN] 2018-07-25 11:26:36.878 [Ruby-0-Thread-6@[main]\>worker0: :1] csv - Error parsing csv {:field=\>"message", :source=\>"\"Siemens AG\",\"INC1358413\",\"OATWIEN\_5023\",\"\",\"Closed\",\"4-Planning (SEV 5)\",\"2018-06-21 15:26:05\",\"siemens.cic.now\",\"2018-06-21 15:29:00\",\"Customer\",\"TECHNICAL SUPPORT\",\"Other\",\"2018-06-25 15:55:10\",\"\",\"0\",\"175\",\"ISD - URA 2.0 Connectivity Issue: Die URA 2.0 Verbindung ist nicht m\xF6glich. / No URA connection possible via home WLAN a\",\"16895148\",\"INC4253004\",\"2018-06-25 15:55:12\",\"fatmasalem.salemabdelaziz\",\"2018-06-21 15:26:05\",\"2018-06-21 15:26:05\",\"siemens CIC to NOW\",\"\",\"\",\"false\",\"0\",\"Inquiry / Help\",\"\",\"175\",\"false\",\"true\",\"0\",\"false\",\"0\"", :exception=\>#\<CSV::MalformedCSVError: Illegal quoting in line 1.\>}  
[WARN] 2018-07-25 11:26:37.908 [Ruby-0-Thread-6@[main]\>worker0: :1] csv - Error parsing csv {:field=\>"message", :source=\>"\"CARL ZEISS AG\",\"INC1336871\",\"DEAAL10\",\"\",\"Closed\",\"3-Low (SEV 3)\",\"2018-05-29 13:18:23\",\"cic.cz.now\",\"2018-06-25 23:54:00\",\"Customer\",\"OTHER\",\"Other\",\"2018-06-25 22:00:34\",\"FORCE CLOSE\",\"0\",\"2,370,937\",\"Keine Anmeldungsm\xF6glichkeit\",\"16832413\",\"INC0636377\",\"2018-06-25 23:54:34\",\"cic.clarify.now\",\"2018-05-29 13:18:23\",\"2018-05-29 13:18:23\",\"CIC Zeiss Now\",\"Network Security\",\"\",\"false\",\"0\",\"Inquiry / Help\",\"Closed/Resolved by Caller\",\"2370937\",\"true\",\"true\",\"5\",\"false\",\"0\"", :exception=\>#\<CSV::MalformedCSVError: Illegal quoting in line 1.\>}

**Below is the logstash conf file**

input{  
file{  
path =\> "/home/santra/Incidents\_V2-2018-06-26\_02\_45\_01.csv"  
start\_position =\> "beginning"  
sincedb\_path =\> "/dev/null"  
}  
}  
filter{  
csv{  
separator =\> ","  
columns =\> ["company","number","cmdb\_ci","cmdb\_ci\_u\_service","incident\_state","priority","sys\_created\_on","sys\_created\_by","u\_cleared","u\_clear\_code\_u\_responsible\_party","u\_clear\_code","u\_clear\_code\_u\_specific","closed\_at","u\_close\_code","business\_stc","calendar\_stc","short\_description","u\_clarify\_case\_id","u\_customer\_fault\_no","sys\_updated\_on","sys\_updated\_by","u\_actual\_fault\_time","opened\_at","opened\_by","u\_business\_services\_ref\_u\_business\_service\_name","cmdb\_ci\_u\_customer\_device\_name","active","business\_duration","category","close\_code","calendar\_duration","u\_flapping","made\_sla","reopen\_count","u\_site\_level","time\_worked"]  
}  
}  
output {  
elasticsearch {  
hosts =\> "[http://127.0.0.1:9200](http://127.0.0.1:9200)"  
}  
}

**Below is the sample CSV file**

"Siemens AG","INC1360290","","","Closed","4-Planning (SEV 5)","2018-06-25 00:01:32","siemens.cic.now","2018-06-25 00:13:00","Customer","CANCELLED FAULT REPORT","Customer Requested","2018-06-25 00:01:32","","0","688","Unable to open the site after connect URA 2.0 - INC3811872","16902161","INC4002983","2018-06-25 00:15:02","cic.clarify.now","2018-06-25 00:01:32","2018-06-25 00:01:32","siemens CIC to NOW","","","false","0","Inquiry / Help","","688","false","true","0","false","0"  
"VISA","INC1360289","PWIL044","IPVPN","Closed","2-Moderate (SEV 2)","2018-06-25 00:00:36","Proactive","2018-06-25 02:24:00","Orange","NETWORK ROUTING & CONFIG","Other","2018-06-25 02:24:39","FORCE CLOSE","8,604","8,604","PWIL044 - Fault - pwil044 with IP Address 10.227.29.61 is Down","16902160","","2018-06-25 02:24:40","cic.clarify.now","2018-06-25 00:00:00","2018-06-25 00:00:36","Proactive","","","false","8604","Inquiry / Help","","8604","false","true","0","false","0"  
"Siemens AG","INC1360288","OINCOIMB4704","","Closed","4-Planning (SEV 5)","2018-06-25 00:00:30","siemens.cic.now","2018-06-25 00:07:00","Orange","NO FAULT FOUND","Polling Failure","2018-06-25 00:00:30","FORCE CLOSE","0","390","PCJB040 - - ALARM DETECTED IN SUPERVISI","16902159","INC4225108","2018-06-25 00:08:49","cic.clarify.now","2018-06-25 00:00:30","2018-06-25 00:00:30","siemens CIC to NOW","","","false","0","Inquiry / Help","","390","false","true","0","false","0"  
"VISA","INC1360287","PMRU134","IPVPN","Closed","2-Moderate (SEV 2)","2018-06-25 00:00:06","Proactive","2018-06-25 02:22:00","Orange","NETWORK ROUTING & CONFIG","Other","2018-06-25 02:23:15","FORCE CLOSE","8,514","8,514","PMRU134 - Fault - pmru134 with IP Address 10.227.37.125 is Down","16902157","","2018-06-25 02:23:19","cic.clarify.now","2018-06-24 23:59:00","2018-06-25 00:00:06","Proactive","","","false","8514","Inquiry / Help","","8514","false","true","0","false","0"  
"AP Moller Maersk","INC1360286","PKUL1733","IPVPN","Closed","2-Moderate (SEV 2)","2018-06-25 00:00:03","Proactive","2018-06-25 03:21:00","Customer","NETWORK ROUTING & CONFIG","Other","2018-06-25 03:22:31","FORCE CLOSE","12,057","12,057","PKUL1733 - Fault - IP SLA Operation Type HTTP named PKUL1733 -\> Tun81 Zscaler HTTP Internet on node pkul1733 is Up. Message is","16902158","","2018-06-25 03:22:40","cic.clarify.now","2018-06-25 00:00:03","2018-06-25 00:00:03","Proactive","","PKUL1733","false","12057","Inquiry / Help","","12057","true","true","1","false","0"  
"AkzoNobel\_PPC","INC1360285","PCEG215","Business VPN Corporate","Closed","1-High (SEV 1)","2018-06-24 23:57:00","Proactive","2018-06-25 04:04:00","Orange","NO FAULT FOUND","Cleared Before Testing","2018-06-25 04:06:20","FORCE CLOSE","0","14,820","PCEG215 - Fault - Node pceg215 with IP Address 10.246.171.221 is Down","16902153","","2018-06-25 04:06:24","cic.clarify.now","2018-06-24 23:56:00","2018-06-24 23:57:00","Proactive","","PCEG215","false","0","Inquiry / Help","","14820","false","true","0","false","0"

Wanted help to understand the what is causing such error

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 25, 2018, 1:00pm UTC](https://discuss.elastic.co/t/error-while-parsing-csv-file-using-logstash/141552/2 "2018-07-25T13:00:07Z")

</div>

That filter successfully parses all the examples for me (running 6.3.1). I do not see any quoting issue in the line it is complaining about.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 22, 2018, 1:00pm UTC](https://discuss.elastic.co/t/error-while-parsing-csv-file-using-logstash/141552/3 "2018-08-22T13:00:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.