# How to send csv file to logstash using filebeat

**URL:** https://discuss.elastic.co/t/how-to-send-csv-file-to-logstash-using-filebeat/132334
**Category:** Logstash
**Created:** [May 17, 2018, 12:56pm UTC](https://discuss.elastic.co/t/how-to-send-csv-file-to-logstash-using-filebeat/132334 "2018-05-17T12:56:56Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Adansar](https://avatars.discourse-cdn.com/v4/letter/a/b4bc9f/32.png) [@Adansar](https://discuss.elastic.co/u/Adansar)
#### Post date: [May 17, 2018, 12:56pm UTC](https://discuss.elastic.co/t/how-to-send-csv-file-to-logstash-using-filebeat/132334/1 "2018-05-17T12:56:56Z")

</div>

Hello,  
I'm trying to send csv data to logstash using filebeat, but i don't get the data on kibana.

filebeat.yml

paths:  
- C:\ELK\filebeat-5.6.2\logs\*.csv  
- C:\ELK\filebeat-5.6.2\logs\test.log  
input\_type: log  
document\_type: log-reports

logstash.conf

input {  
beats {  
port =\> 5044  
}  
}  
filter {  
if "log-facturation" in [type]{  
grok {  
match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:date} %{LOGLEVEL:level} [%{DATA:fonction}] %{GREEDYDATA:source} - %{GREEDYDATA:message}" }  
}  
date {  
match =\> ["date", "ISO8601"]  
}  
}  
if "log-reports" in [type]{  
csv {  
}  
}  
}  
output {  
elasticsearch {  
index =\> "toto"  
hosts =\> "localhost:9200"  
}  
}

Thank you

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 17, 2018, 2:13pm UTC](https://discuss.elastic.co/t/how-to-send-csv-file-to-logstash-using-filebeat/132334/2 "2018-05-17T14:13:55Z")

</div>

Look in your logs (both Filebeat and Logstash). Does Filebeat appear to be having issues sending to Logstash? Does Logstash appear to be having issues sending to Elasticsearch?

---

<div class="post-metadata">

### Author: ![Adansar](https://avatars.discourse-cdn.com/v4/letter/a/b4bc9f/32.png) [@Adansar](https://discuss.elastic.co/u/Adansar)
#### Post date: [May 17, 2018, 2:24pm UTC](https://discuss.elastic.co/t/how-to-send-csv-file-to-logstash-using-filebeat/132334/3 "2018-05-17T14:24:41Z")

</div>

Hello, thank you for your answer.  
No, both of them are running well, i've problem just when sending a csv file

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 17, 2018, 8:31pm UTC](https://discuss.elastic.co/t/how-to-send-csv-file-to-logstash-using-filebeat/132334/4 "2018-05-17T20:31:24Z")

</div>

If Filebeat is actually sending anything to Logstash there should be signs of it in the log. Definitely if you increase the log level. To remove an error source you can replace the elasticsearch output with e.g. a file output that dumps the messages to a file in /tmp. What does the rest of your Filebeat configuration look like (non-comment lines only please, and format it as preformatted text so it doesn't get mangled).

---

<div class="post-metadata">

### Author: ![Adansar](https://avatars.discourse-cdn.com/v4/letter/a/b4bc9f/32.png) [@Adansar](https://discuss.elastic.co/u/Adansar)
#### Post date: [May 22, 2018, 7:57am UTC](https://discuss.elastic.co/t/how-to-send-csv-file-to-logstash-using-filebeat/132334/5 "2018-05-22T07:57:33Z")

</div>

Hello,  
Sorry for being late ☹ the problem was in the file encoding.. I created a new file on my desktop, fill it with the informations of the last file, then put the path in the filebeat.yml and it worked.  
Thank you so much M.BAECK

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 19, 2018, 7:57am UTC](https://discuss.elastic.co/t/how-to-send-csv-file-to-logstash-using-filebeat/132334/6 "2018-06-19T07:57:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
