Index from Elasticsearch to excel

Elastic Stack Logstash
1

How can i export data from ES to excel file?

2

Perhaps you should edit your post and move it to the Elasticsearch category? I don't see how this is Logstash-related.

3

Because I am using

input {
elasticsearch {
hosts => ["localhost:9200"] index => "logs"
query => '{
"query": {
"bool": {
"must": {
"match":{
"_type": "logs"
}
}
}
}
}'
}
}

output {
csv {
fields => ["_id","timestamp","_index","severity","_score","_type","host","path","duration","context","component"]
path => "D:/mongolog4.csv"
}
stdout {}
}

And my Index looks like

March 7th 2017, 14:39:14.962 severity:I duration:6 path:C:/data/log/mongo256.log component:COMMAND host:DESKTOP-PKMSR1Q context:conn48229 content:command hgcommon.Notification command: aggregate { aggregate: "Notification", pipeline: [ { $match: { RecipientId: "194f85dd-792d-11e6-8b8f-9130e4dd6a56", Deleted: false, Important: true } }, { $sort: { _id: -1 } }, { $limit: 10 } ] } keyUpdates:0 writeConflicts:0 numYields:5219 reslen:2956 locks:{ Global: { acquireCount: { r: 10444 } }, Database: { acquireCount: { r: 5222 } }, Collection: { acquireCount: { r: 5222 } } } protocol:op_query 100 timestamp:March 7th 2017, 14:39:14.962 _id:AVsOXsI1sMBbPmbQNsDj _type:logs _index:logs _score: -
Link to /logs/logs/AVsOXsI1sMBbPmbQNsDj
Table
JSON
t _id AVsOXsI1sMBbPmbQNsDj
t _index logs

_score -

t _type logs
t component COMMAND
t content command hgcommon.Notification command: aggregate { aggregate: "Notification", pipeline: [ { $match: { RecipientId: "194f85dd-792d-11e6-8b8f-9130e4dd6a56", Deleted: false, Important: true } }, { $sort: { _id: -1 } }, { $limit: 10 } ] } keyUpdates:0 writeConflicts:0 numYields:5219 reslen:2956 locks:{ Global: { acquireCount: { r: 10444 } }, Database: { acquireCount: { r: 5222 } }, Collection: { acquireCount: { r: 5222 } } } protocol:op_query 100
t context conn48229

duration 6

t host DESKTOP-PKMSR1Q
t path C:/data/log/mongo256.log
t severity I
timestamp March 7th 2017, 14:39:14.962

And its output is
C:\ELK\logstash-5.2.2>bin\logstash -f bin\mongo-csv.conf
Could not find log4j2 configuration at path /ELK/logstash-5.2.2/config/log4j2.properties. Using default config which logs to console
11:21:37.755 [[main]-pipeline-manager] INFO logstash.pipeline - Starting pipeline {"id"=>"main", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>500}
11:21:38.850 [[main]-pipeline-manager] INFO logstash.pipeline - Pipeline main started
11:21:39.131 [Api Webserver] INFO logstash.agent - Successfully started Logstash API endpoint {:port=>9600}
11:21:39.522 [[main]>worker1] INFO logstash.outputs.csv - Opening file {:path=>"D:/mongolog4.csv"}
2017-03-28T05:51:39.475Z DESKTOP-PKMSR1Q %{message}
2017-03-28T05:51:39.475Z DESKTOP-PKMSR1Q %{message}
2017-03-28T05:51:39.475Z DESKTOP-PKMSR1Q %{message}
2017-03-28T05:51:39.475Z DESKTOP-PKMSR1Q %{message}
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}

4

Why didn't you include all that useful information in your first post? The csv output is broken in the csv output plugin that ships with Logstash 5.2. Upgrade to at least 3.0.3. See below.

5

I installed the csv 3.0.3 but it does not change anything. I am still getting the same output.

6

That's surprising. I suggest you report your findings in the issue.

7

Does ES have any plugin i can tryout?

8

Does ES have any plugin i can tryout?

I don't know.

9

Thanks for the help. :slight_smile:

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.