# Error with Logstash CSV Filter plugin

**URL:** https://discuss.elastic.co/t/error-with-logstash-csv-filter-plugin/215879
**Category:** Logstash
**Created:** [January 21, 2020, 12:57pm UTC](https://discuss.elastic.co/t/error-with-logstash-csv-filter-plugin/215879 "2020-01-21T12:57:35Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![mhyager](https://avatars.discourse-cdn.com/v4/letter/m/ed8c4c/32.png) [@mhyager](https://discuss.elastic.co/u/mhyager)
#### Post date: [January 21, 2020, 12:57pm UTC](https://discuss.elastic.co/t/error-with-logstash-csv-filter-plugin/215879/1 "2020-01-21T12:57:35Z")

</div>

I am having strange errors with a specific word used in Column headers. All automatic column header recognition works fine, except for when column headers are called FName. Is this a limitation of the CSV Filter plugin?

The Error Log:

```auto
[2020-01-21T13:13:55,817][WARN][logstash.outputs.elasticsearch][pipelineLLM] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"llmlogs-2020.01-000001", :routing=>nil, :_type=>"_doc"}, #<LogStash::Event:0x11a7198>], :response=>{"index"=>{"_index"=>"llmlogs-2020.01-000001", "_type"=>"_doc", "_id"=>"k9cGyG8BK6Mt9ZOQBvTl", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [FName] of type [float] in document with id 'k9cGyG8BK6Mt9ZOQBvTl'. Preview of field's value: 'FName'", "caused_by"=>{"type"=>"number_format_exception", "reason"=>"For input string: \"FName\""}}}}}
```

---

<div class="post-metadata">

### Author: ![pastechecker](https://avatars.discourse-cdn.com/v4/letter/p/0ea827/32.png) [@pastechecker](https://discuss.elastic.co/u/pastechecker)
#### Post date: [January 21, 2020, 3:47pm UTC](https://discuss.elastic.co/t/error-with-logstash-csv-filter-plugin/215879/2 "2020-01-21T15:47:09Z")

</div>

> [@mhyager](#):
>
> [FName] of type [float]

You have to fix the mappings.

In the error message you clearly see:

```auto
[FName] of type [float] 

```

But elasticsearch already received a document that was mapped as "string".

As a quick fix you can do data conversion in Logstash:

```auto
mutate {
  convert => {
    "Fname" => "string"
  }
}

```

---

<div class="post-metadata">

### Author: ![mhyager](https://avatars.discourse-cdn.com/v4/letter/m/ed8c4c/32.png) [@mhyager](https://discuss.elastic.co/u/mhyager)
#### Post date: [January 22, 2020, 10:45am UTC](https://discuss.elastic.co/t/error-with-logstash-csv-filter-plugin/215879/3 "2020-01-22T10:45:09Z")

</div>

The columns of my CSV are autodetected, so I haven't mapped anything manually so far. When I look into my Kibana Index Patterns, FName is shown as number.

 ![kibana](https://us1.discourse-cdn.com/elastic/original/3X/e/1/e1266127aa71fcbab4bee16a8c425f695438be59.png)

The same goes for my Elasticsearch data:

 ![elasticsearch](https://us1.discourse-cdn.com/elastic/original/3X/1/f/1f89c5d7ef49b8da788fa8e8518a0d77642073a7.png)

FName is the column header. All values in the fields under this column header are decimal point numbers, so float is correct. _ **The error seems to indicate that the parser is trying to cast the column header name "FName" as well, not just the values underneath FName in the column. Or am I misreading that?** _

I cannot see any documents where FName was recognised as a string.

My Mapping template below:

```auto
{
  "numeric_detection": true,
  "dynamic": true,
  "dynamic_templates": [
    {
      "machinename": {
        "mapping": {
          "copy_to": "machinename",
          "type": "string"
        },
        "match": "*.csv"
      }
    }
  ],
  "date_detection": false,
  "properties": {
    "Timestamp": {
      "format": "yyyy-MM-dd'T'HH:mm:ss.SSS'Z'",
      "type": "date"
    }
  }
}
```

Here's part of the mapping in the index after the detection runs:

```auto
      "EngineMisc": {
        "type": "float"
      },
      "EnginePreInit": {
        "type": "float"
      },
      "FMallocUnused": {
        "type": "float"
      },
      "FName": {
        "type": "float"
      },
      "FileSystem": {
        "type": "float"
      },
      "GC": {
        "type": "float"
      },
      "GenericPlatformMallocCrash": {
        "type": "float"
      },
      "InitUObject": {
        "type": "float"
      },
      "LoadMapMisc": {
        "type": "float"
      },
```

My Logstash config:

```auto
input {
  beats {
    port => 5044
  }
}
filter {
  csv {
   id => "LLM"
   autogenerate_column_names => false
   autodetect_column_names => true
   skip_empty_columns => true
   }
}
output {
  stdout { codec => rubydebug }
  elasticsearch { hosts => ["localhost:9200"]
                  index => "llmlogs-2020.01-000001"
  }
}
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 19, 2020, 10:45am UTC](https://discuss.elastic.co/t/error-with-logstash-csv-filter-plugin/215879/4 "2020-02-19T10:45:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.