Error While Parsing CSV file

Elastic Stack Logstash
1

Hi,
I'm using logstash ver logstash-1.5.0.rc2 and trying to parse log files containing lines like :

2015-02-03 06:10:38.6024|MEMSGSERVER|Trace|WcfMessageInspector|14|52e46324-a775-4a91-96d6-7efd3763cf88|END SERVICE REQUEST

Lines have several fields separated by | so trying to parse thru csv filter using config like
Config:

input {

file {

path => "/home/mohan/Downloads/Logs/srlog.log"

start_position => beginning

}

}
filter{
csv {
columns => [ "mytime" , "server" , "event_sev" , "component" , "event_id" , "event_code" , "event_message" ]
separator => "|"
}
}

output {
stdout { }
}

I'm getting error : Trouble parsing csv {:source=>"message", :raw=>"", :exception=>#<NoMethodError: undefined method `each_index' for nil:NilClass>, :level=>:warn}

When I slightly change columns like :
filter{
csv {
columns => [ "@timestamp" , "server" , "event_sev" , "component" , "event_id" , "event_code" , "event_message" ]
separator => "|"
}

I get error :
Trouble parsing csv {:source=>"message", :raw=>"2015-02-03 06:10:38.6024|MEMSGSERVER|Trace|WcfMessageInspector|14|52e46324-a775-4a91-96d6-7efd3763cf88|END SERVICE REQUEST ", :exception=>#<TypeError: The field '@timestamp' must be a (LogStash::Timestamp, not a String (2015-02-03 06:10:38.6024)>, :level=>:warn}

Please help me and let me know if I'm missing something??

-Thanks in Advance

2

I'm getting error : Trouble parsing csv {:source=>"message", :raw=>"", :exception=>#, :level=>:warn}

I believe the "raw" value is the string that it tried to parse, so it looks like there was an empty string in the input file.

Don't try to parse CSV directly into the @timestamp field.

3

Hi,

Thanks for your reply..

Exact message is :
Trouble parsing csv {:source=>"message", :raw=>"2015-02-03 19:54:34.5477|DCAOTSERVER|Trace|Workflow.S2R|5||Key Active Start Time: 2/3/2015 2:45:00 PM, Key Active End Time: 2/5/2015 2:00:00 PM ", :exception=>#<TypeError: The field '@timestamp' must be a (LogStash::Timestamp, not a String (2015-02-03 19:54:34.5477)>, :level=>:warn}

What could be the issue?? Is there any way to parse the time in @timestamp?

-Thanks

4

Again, don't try to parse CSV directly into the @timestamp field. Have the csv filterstore the timestamp in a temporary field (call it timestamp or whatever) and use the date filter to parse that field and store the result in the @timestamp field.