Export to CSV with all fields - Logstash 7.0.1

Elastic Stack Logstash
2

Fields is a required option. It does not support %{[fieldname]} references but it will support environment variable substitution. However, it will treat a substituted environment variable as a string, even if it looks like an array. So the answer is no.

Except you can have logstash tell you what to type, which reduces it to copy and paste. Run a line of your data through this...

filter {
    ruby {
        code => '
            csvFields = []
            event.to_hash.each { |k, v|
                csvFields << k
            }
            event.set("[csvFields]", csvFields.to_s)
        '
    }
}
output { stdout { codec => plain { format => "%{csvFields}
" } } }
1 Like