# How to configure logstash to identify column headers?

**URL:** <https://discuss.elastic.co/t/how-to-configure-logstash-to-identify-column-headers/66181>\
**Category:** Logstash\
**Created:** [November 16, 2016, 12:29am UTC](https://discuss.elastic.co/t/how-to-configure-logstash-to-identify-column-headers/66181 "2016-11-16T00:29:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![deepu.sundar](https://avatars.discourse-cdn.com/v4/letter/d/e0b2c6/32.png) [@deepu.sundar](https://discuss.elastic.co/u/deepu.sundar)\
**Post date:** [November 16, 2016, 12:29am UTC](https://discuss.elastic.co/t/how-to-configure-logstash-to-identify-column-headers/66181/1 "2016-11-16T00:29:00Z")

</div>

Hi,

Is there way to configure Logstash (in ELK) such that the first line wil be identified as the column header and then it will create and index the remaining records based on that.

Appreciate any help on this .

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 20, 2016, 4:25pm UTC](https://discuss.elastic.co/t/how-to-configure-logstash-to-identify-column-headers/66181/2 "2016-11-20T16:25:53Z")

</div>

I think [https://github.com/logstash-plugins/logstash-filter-csv/pull/36](https://github.com/logstash-plugins/logstash-filter-csv/pull/36) added what you're looking for. The online documentation hasn't been regenerated but the feature should be available at least in the csv plugin shipped with Logstash 5.0.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 18, 2016, 4:26pm UTC](https://discuss.elastic.co/t/how-to-configure-logstash-to-identify-column-headers/66181/3 "2016-12-18T16:26:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
