How can i parse the data with comma seperated in logstash

(rajkumar) #1

I have the below log format which is sending it to logstash through filebeat.
I would like to create fields from these and send it to kibana.

server1, cpu, 10, xinfo xyz wwer 2, xyzz
server2, mem, 25 , xyzinfo abc 12345 abinfo, 234info , abcd

basically i am looking for filter which can create fields by using comma separator.
The log file is not a csv format file, its a plain text file.
can someone please help

(Mark Walkom) #2 should be what you want.

(rajkumar) #3

thanks Warkolm,

i have tried like below.
if the file is not csv formatted, will the cvs filter works? please let me know
do i need to use grok after csv?

filter {

    if [type] == "log" and [log_type] == "winlog" {
            csv {
                    columns => [
                    separator => ","


(Mark Walkom) #4

That should work fine, you won't need grok.


hope this example helps you,

(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.