Good morning Cad. I finally imported my csv containing Jason Logs using this code:
input {
file {
codec => multiline {
pattern => ";"
negate => true
what => previous
}
start_position => "beginning"
path => "C:/Users/Valerio/Desktop/JASON/Logs.csv"
sincedb_path => "nul"
}
}
filter {
kv {
source => "message"
field_split => ","
value_split => ":"
remove_char_key => "\""
remove_char_value => "\""
}
mutate {
remove_field => [ "message", "path", "host", "@timestamp", "@version", "tags"]
}
}
output { elasticsearch {
hosts => "http://localhost:9200"
index => "logs"
}
stdout {}
}
As you can see i used a kv plugin in order to create my 15 fields deriving from the content of the Json logs.
As pattern separator I used the ";" because my csv file is separated by it. In this way I parsed correctly all the log but the last one is omitted. In fact, during the index creation on elasticsearch i can choose between two different TimeStamp, the first relative to the first 499 rows of my file, the second relative to the last row of it (row n. 500). The structure in the Jason is the same in all the rows of the csv so i don't understand why the last one is used differently. Can you suggest something?
Secondly, my original csv contains not only Jason logs but even ordinary columns to import. How can i import a csv containing even and not only multiline logs in it?