# Failing to parse csv

**URL:** <https://discuss.elastic.co/t/failing-to-parse-csv/108613>\
**Category:** Logstash\
**Created:** [November 21, 2017, 8:10pm UTC](https://discuss.elastic.co/t/failing-to-parse-csv/108613 "2017-11-21T20:10:01Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![chikondot](https://avatars.discourse-cdn.com/v4/letter/c/87869e/32.png) [@chikondot](https://discuss.elastic.co/u/chikondot)\
**Post date:** [November 21, 2017, 8:10pm UTC](https://discuss.elastic.co/t/failing-to-parse-csv/108613/1 "2017-11-21T20:10:01Z")

</div>

Good day,

I am trying to parse multiple csv files in a directory for trend analysis and report generation,  
Index is being created but not all information is being parsed. The error below is being displayed

[ERROR] 2017-11-21 21:27:27.067 [Ruby-0-Thread-3: /usr/share/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.23/lib/stud/task.rb:22] agent - An unexpected error occurred! {:message=\>"Permission denied - /etc/logstash/conf.d/logstash-simple.conf", :class=\>"Errno::EACCES", :backtrace=\>["org/jruby/RubyIO.java:3804:in `read'", "org/jruby/RubyIO.java:3987:in`read'", "/usr/share/logstash/logstash-core/lib/logstash/config/loader.rb:80:in `local_config'", "org/jruby/RubyArray.java:1613:in`each'", "/usr/share/logstash/logstash-core/lib/logstash/config/loader.rb:73:in `local_config'", "/usr/share/logstash/logstash-core/lib/logstash/config/loader.rb:46:in`load\_config'", "/usr/share/logstash/logstash-core/lib/logstash/config/loader.rb:15:in `format_config'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:304:in`fetch\_config'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:312:in `reload_pipeline!'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:111:in`reload\_state!'", "org/jruby/RubyHash.java:1342:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:108:in`reload\_state!'", "org/jruby/ext/thread/Mutex.java:149:in `synchronize'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:107:in`reload\_state!'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:75:in `execute'", "org/jruby/RubyProc.java:281:in`call'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.23/lib/stud/interval.rb:20:in `interval'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:75:in`execute'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:320:in `execute'", "org/jruby/RubyProc.java:281:in`call'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.23/lib/stud/task.rb:24:in `initialize'"]}

Please find below config file: logstash-simple.conf

input {  
file {  
path =\> "/home/africom/backup3/data\*.csv"  
start\_position =\> "end"  
sincedb\_path =\>"/dev/null"  
type =\> "data\_record"  
}  
}

filter {  
if [type] == "data\_record"{  
csv {  
separator =\> "|"  
skip\_empty\_columns =\> true  
mutate {  
rename =\> {"column1" =\> "index"}  
rename =\> {"column3" =\> "system\_time"}  
rename =\> {"column5" =\> "msdn"}  
rename =\> {"column8" =\> "imsi"}  
rename =\> {"column13" =\> "session\_start"}  
rename =\> {"column16" =\> "session\_end"}  
rename =\> {"column17" =\> "data\_volume"}  
rename =\> {"column74" =\> "needs\_to\_be\_id"}  
}  
}  
output {  
elasticsearch {  
hosts =\> ["192.168.88.101:9200"]  
index =\> "fourth"  
}  
stdout { codec =\> rubydebug }  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 22, 2017, 6:20am UTC](https://discuss.elastic.co/t/failing-to-parse-csv/108613/2 "2017-11-22T06:20:48Z")

</div>

> Permission denied - /etc/logstash/conf.d/logstash-simple.conf

So have you checked the permissions of that file?

---

<div class="post-metadata">

**Author:** ![chikondot](https://avatars.discourse-cdn.com/v4/letter/c/87869e/32.png) [@chikondot](https://discuss.elastic.co/u/chikondot)\
**Post date:** [November 22, 2017, 2:58pm UTC](https://discuss.elastic.co/t/failing-to-parse-csv/108613/3 "2017-11-22T14:58:05Z")

</div>

Good day magnus,

The current permissions on the file listed below

-rwxr-xr-- 1 root root 3167 Nov 22 05:48 logstash-simple.conf

Do they need to be changed in any further way?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 22, 2017, 8:11pm UTC](https://discuss.elastic.co/t/failing-to-parse-csv/108613/4 "2017-11-22T20:11:48Z")

</div>

No, that looks okay (although mode 644 would've made more sense than 754). Not sure what's up here.

---

<div class="post-metadata">

**Author:** ![chikondot](https://avatars.discourse-cdn.com/v4/letter/c/87869e/32.png) [@chikondot](https://discuss.elastic.co/u/chikondot)\
**Post date:** [November 23, 2017, 4:40am UTC](https://discuss.elastic.co/t/failing-to-parse-csv/108613/5 "2017-11-23T04:40:21Z")

</div>

Magnus,

I have re-installed logstash and that seems to have removed the permission issue(Using your suggestion of 644 for mode)  
The problem now is this error:

:message=\>"Unhandled IOException: java.io.IOException: unhandled errno: Too many open files"

An index is being created and some of the data is present, but not all  
I am sourcing the data from multiple files. snippet of format of data below(if that may help)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/4/b44fdf02f052f7962efb972bb8b6569bd295be16.png)54456138 0 20171115143642 1 2.63864E+12 -1 648448644218931 20171115164808 0 20171115163232 6144  
54456145 0 20171115143750 1 2.63864E+12 -1 648448644215611 20171115164916 0 20171115164433 139264  
54456146 0 20171115143754 1 2.63864E+12 -1 648448644206356 20171115164920 0 20171115164729 159744  
54456147 0 20171115143755 1 2.63864E+12 -1 648448644216975 20171115164921 0 20171115163501 1024  
54456149 0 20171115143759 1 2.63864E+12 -1 648448644224596 20171115164925 0 20171115163846 0

Please assist  
Thank you

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 23, 2017, 6:31am UTC](https://discuss.elastic.co/t/failing-to-parse-csv/108613/6 "2017-11-23T06:31:23Z")

</div>

Does the filename pattern matches _thousands_ of files, or why might you be getting the "too many open files" error?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 21, 2017, 6:31am UTC](https://discuss.elastic.co/t/failing-to-parse-csv/108613/7 "2017-12-21T06:31:58Z")

</div>

Closed on December 21, 2017, 6:31am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
