# Field Parse Issue

**URL:** <https://discuss.elastic.co/t/field-parse-issue/304596>\
**Category:** Logstash\
**Tags:** docker\
**Created:** [May 12, 2022, 3:08pm UTC](https://discuss.elastic.co/t/field-parse-issue/304596 "2022-05-12T15:08:31Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![hasnainNM](https://avatars.discourse-cdn.com/v4/letter/h/7c8e57/32.png) [@hasnainNM](https://discuss.elastic.co/u/hasnainNM)\
**Post date:** [May 12, 2022, 3:08pm UTC](https://discuss.elastic.co/t/field-parse-issue/304596/1 "2022-05-12T15:08:31Z")

</div>

I have CSV field & logstash ins't parsing it entirely, i have the first few fields parsed correctly yet once it comes across console it seems to stop parsing. Any idea of fixes?

Here is my code

```auto

filter {
    csv {
        columns => ["rcd", "ASID", "TIMESTAMP", "SMFID", "JOBNUM", "CONSOLE", "ROUTECODE", "DESCRIPTOR", "JOBNAME", "FLAGS", "TEXT"]
        separator => ","
    }
    mutate { add_field => { "[@metadata][timestamp]" => "%{TIMESTAMP}" }}
    date { match => ["[@metadata][timestamp]", "yyD HH.mm.ss.SSS Z"] } 
}

```

---

<div class="post-metadata">

**Author:** ![hasnainNM](https://avatars.discourse-cdn.com/v4/letter/h/7c8e57/32.png) [@hasnainNM](https://discuss.elastic.co/u/hasnainNM)\
**Post date:** [May 12, 2022, 4:12pm UTC](https://discuss.elastic.co/t/field-parse-issue/304596/2 "2022-05-12T16:12:41Z")

</div>

My data had spaces. I guess it doesn't like spaces in this new update?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 12, 2022, 4:16pm UTC](https://discuss.elastic.co/t/field-parse-issue/304596/3 "2022-05-12T16:16:01Z")

</div>

What does your [message] field look like?

---

<div class="post-metadata">

**Author:** ![hasnainNM](https://avatars.discourse-cdn.com/v4/letter/h/7c8e57/32.png) [@hasnainNM](https://discuss.elastic.co/u/hasnainNM)\
**Post date:** [May 12, 2022, 6:27pm UTC](https://discuss.elastic.co/t/field-parse-issue/304596/4 "2022-05-12T18:27:54Z")

</div>

My customData.log file  
{"Time": "2022-05-12T04:18:46.077", "HostName": "ABCDEFG", "Cat": "JOBLOG", "Severity": "Err", "SAF": 1, "SAFD": "RACF", "Name": "TEST", "JobName": "DBS1MSTR", "JobID": "JOB12345", "Rec": " 23:18:36 ERROR ID=DSNLIRTR000300000000000::172.31.206.121 FOR THREAD WITH"}

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 12, 2022, 6:43pm UTC](https://discuss.elastic.co/t/field-parse-issue/304596/5 "2022-05-12T18:43:20Z")

</div>

That's not CSV it is JSON. Try a json filter.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 9, 2022, 6:44pm UTC](https://discuss.elastic.co/t/field-parse-issue/304596/6 "2022-06-09T18:44:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.