# How to parse csv using logstash **URL:** \ **Category:** Logstash\ **Created:** [January 10, 2018, 9:56am UTC](https://discuss.elastic.co/t/how-to-parse-csv-using-logstash/114823 "2018-01-10T09:56:46Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Saket\_Kumar](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)\ **Post date:** [January 10, 2018, 9:56am UTC](https://discuss.elastic.co/t/how-to-parse-csv-using-logstash/114823/1 "2018-01-10T09:56:46Z")
I have CSV files where columns are in following sequence--\> File1: A,B,C,D File2: A,C,D,B I have to parse only A and B columns. how to map this and push to ES. ---
**Author:** ![Saket\_Kumar](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)\ **Post date:** [January 10, 2018, 9:59am UTC](https://discuss.elastic.co/t/how-to-parse-csv-using-logstash/114823/2 "2018-01-10T09:59:26Z")
I am not sure about the sequence of columns in the Third file, however the columns A and B be persisting in the file. I have to pick A and B. IS there any way? With CSV filter you need to define columns. but in case of many files where sequence is not sure how to extract specific columns by just names. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 10, 2018, 10:01am UTC](https://discuss.elastic.co/t/how-to-parse-csv-using-logstash/114823/3 "2018-01-10T10:01:59Z")
Look at the auto detection options. But you will probably have an option only keeping two columns and removing all others. Logstash will let you remove things, but you need to know the names. ---
**Author:** ![Saket\_Kumar](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)\ **Post date:** [January 10, 2018, 10:06am UTC](https://discuss.elastic.co/t/how-to-parse-csv-using-logstash/114823/4 "2018-01-10T10:06:22Z")
What is auto detection options. please elaborate. I know the names which i can remove any time. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 10, 2018, 10:07am UTC](https://discuss.elastic.co/t/how-to-parse-csv-using-logstash/114823/5 "2018-01-10T10:07:49Z")
Have a look at [https://www.elastic.co/guide/en/logstash/6.1/plugins-filters-csv.html](https://www.elastic.co/guide/en/logstash/6.1/plugins-filters-csv.html) ---
**Author:** ![Saket\_Kumar](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)\ **Post date:** [January 10, 2018, 10:09am UTC](https://discuss.elastic.co/t/how-to-parse-csv-using-logstash/114823/6 "2018-01-10T10:09:00Z")
Do you mean "autodetect\_column\_names"? ---
**Author:** ![Saket\_Kumar](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)\ **Post date:** [January 10, 2018, 10:10am UTC](https://discuss.elastic.co/t/how-to-parse-csv-using-logstash/114823/7 "2018-01-10T10:10:00Z")
Thanks I will give a try. Thank you very much. ---
**Author:** ![Krunal\_kalaria](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krunal_kalaria/32/23862_2.png) [@Krunal\_kalaria](https://discuss.elastic.co/u/Krunal_kalaria)\ **Post date:** [January 10, 2018, 11:33am UTC](https://discuss.elastic.co/t/how-to-parse-csv-using-logstash/114823/8 "2018-01-10T11:33:01Z")
Hi @Saket_Kumar, Can you send one log sample ? so i know that exactly what you want. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 7, 2018, 11:33am UTC](https://discuss.elastic.co/t/how-to-parse-csv-using-logstash/114823/9 "2018-02-07T11:33:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.