# Logstash 5.0 Alpha 4 csv input and mutate split error **URL:** \ **Category:** Logstash\ **Created:** [July 19, 2016, 8:16pm UTC](https://discuss.elastic.co/t/logstash-5-0-alpha-4-csv-input-and-mutate-split-error/55923 "2016-07-19T20:16:58Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![tcaudrey](https://avatars.discourse-cdn.com/v4/letter/t/71e660/32.png) [@tcaudrey](https://discuss.elastic.co/u/tcaudrey)\ **Post date:** [July 19, 2016, 8:16pm UTC](https://discuss.elastic.co/t/logstash-5-0-alpha-4-csv-input-and-mutate-split-error/55923/1 "2016-07-19T20:16:58Z")
Hi - I have simple .csv input files and a Logstash config that worked fine with Logstash 2.3.x, but when trying to use the same input files and config file in Logstash 5.0 aplha 4 produces the following error and crashes the pipeline: > An unexpected error occurred! {:error=\>#\>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-3.0.1/lib/logstash/filters/mutate.rb:390:in `split'", "org/jruby/RubyHash.java:1342:in `each'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-3.0.1/lib/logstash/filters/mutate.rb:389:in `split'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-3.0.1/lib/logstash/filters/mutate.rb:226:in `filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:155:in `multi\_filter'", "org/jruby/RubyArray.java:1613:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:152:in `multi\_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filter\_delegator.rb:42:in `multi_filter'", "(eval):164:in `initialize'", "org/jruby/RubyArray.java:1613:in `each'", "(eval):159:in `initialize'", "org/jruby/RubyProc.java:281:in `call'", "(eval):179:in `initialize'", "org/jruby/RubyArray.java:1613:in `each'", "(eval):175:in `initialize'", "org/jruby/RubyProc.java:281:in `call'", "(eval):123:in `filter\_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:287:in `filter_batch'", "org/jruby/RubyArray.java:1613:in `each'", "org/jruby/RubyEnumerable.java:852:in `inject'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:285:in `filter\_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:237:in `worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:210:in `start\_workers'"], :level=\>:fatal} The input lines are all in csv files and the contents are all like: > d 2016-07-18 12:47:06+0100 2016-07-18 12:47:05+0100 [bo-1R8-4D9LK-3KH3KG-C0469@cmp.dotmailer.co.uk](mailto:bo-1R8-4D9LK-3KH3KG-C0469@cmp.dotmailer.co.uk)[phil.mcnally@rsmtenon.com](mailto:phil.mcnally@rsmtenon.com) relayed 2.0.0 (success) smtp 250 ok 1468842426 qp 4814 [server-13.tower-208.messagelabs.com](http://server-13.tower-208.messagelabs.com)!1468842425!21681222!1 [cluster1.eu.messagelabs.com](http://cluster1.eu.messagelabs.com) (195.245.230.83) smtp sov-dm-droid8 (10.20.101.219) smtp 172.20.114.14 195.245.230.83 PIPELINING,8BITMIME,STARTTLS 42751 105-114 [RSM UK - Home](http://rsmtenon.com/105-114) dotMailerNeutral9 The config file that fails is: > input { > file { > path =\> ["/var/log/pmta/powermta07/\*.csv"] > tags =\> ["pmta4.0"] > sincedb\_path =\> "/etc/logstash/db/sincedb-pmtav4-powermta07" > sincedb\_write\_interval =\> "15" > discover\_interval =\> "15" > start\_position =\> "beginning" > } > } > filter { > > # Set CSV columns > > if "pmta4.0" in [tags] { > csv { > columns =\> [ > "msgtype", > "timeLogged", > "timeQueued", > "orig", > "rcpt", > "orcpt", > "dsnAction", > "dsnStatus", > "dsnDiag", > "dsnMta", > "bounceCat", > "srcType", > "srcMta", > "dlvType", > "dlvSourceIp", > "dlvDestinationIp", > "dlvEsmtpAvailable", > "dlvSize", > "vmta", > "jobId", > "envId", > "queue", > "vmtaPool" > ] > ``` > add_field => { "domain" => "%{rcpt}" } > add_field => { "origDomain" => "%{orig}" } > add_field => { "AccountID" => "%{orig}" } > add_field => { "dlvPublicIp" => "%{dlvSourceIp}" } > ##-- csv-pmta tag - TO BE REMOVED --## > add_tag => "csv-pmta" > } > > ``` > ``` > # Check if CSV was parsed correctly > if [srcType] == "smtp" and "@" in [rcpt] { > > ``` > ``` > # Set message timestamp using timelogged field > date { > match => ["timeLogged", "YYYY-MM-dd HH:mm:ssZ"] > } > > ``` > ``` > # Re-write fields that we search on to lowercase as we use not_analyzed strings > mutate { > lowercase => ["rcpt"] > lowercase => ["origDomain"] > lowercase => ["domain"] > } > > ``` > ``` > # Split fields to arrays using seperators > mutate { > split => { "domain" => "@" } > } > } > > ``` > > } > } > } > output { > if "csv-pmta" in [tags] { > elasticsearch { > hosts =\> "192.168.0.231" > index =\> "powermta-%{msgtype}-%{+YYYY.MM.dd}" > document\_type =\> "powermta" > template =\> "/etc/logstash/powermta-template.json" > template\_name =\> "powermta" > template\_overwrite =\> true > document\_id =\> "%{@uuid}" > flush\_size =\> "15000" > } > } > else { > elasticsearch { > hosts =\> "192.168.0.231:9200" > index =\> "pmta\_incomplete-%{msgtype}-%{+YYYY.MM.dd}" > } > } > } However, if I exclude the: > ``` > mutate { > split => { "domain" => "@" } > } > > ``` The error goes away and the logs are processed. There's a lot more processing to be done after this part of the config, but I can't get past this issue to complete the rest of the processing Any ideas would be greatly appreciated!!! Thanks in advance, TimC ---
**Author:** ![tcaudrey](https://avatars.discourse-cdn.com/v4/letter/t/71e660/32.png) [@tcaudrey](https://discuss.elastic.co/u/tcaudrey)\ **Post date:** [July 19, 2016, 8:22pm UTC](https://discuss.elastic.co/t/logstash-5-0-alpha-4-csv-input-and-mutate-split-error/55923/3 "2016-07-19T20:22:28Z")
Sorry the full error code truncated it is: `An unexpected error occurred! {:error=>#, :backtrace=\>["/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-3.0.1/lib/logstash/filters/mutate.rb:390:in `split'", "org/jruby/RubyHash.java:1342:in`each'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-3.0.1/lib/logstash/filters/mutate.rb:389:in `split'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-3.0.1/lib/logstash/filters/mutate.rb:226:in`filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:155:in `multi_filter'", "org/jruby/RubyArray.java:1613:in`each'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:152:in `multi_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filter_delegator.rb:42:in`multi\_filter'", "(eval):164:in `initialize'", "org/jruby/RubyArray.java:1613:in`each'", "(eval):159:in `initialize'", "org/jruby/RubyProc.java:281:in`call'", "(eval):179:in `initialize'", "org/jruby/RubyArray.java:1613:in`each'", "(eval):175:in `initialize'", "org/jruby/RubyProc.java:281:in`call'", "(eval):123:in `filter_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:287:in`filter\_batch'", "org/jruby/RubyArray.java:1613:in `each'", "org/jruby/RubyEnumerable.java:852:in`inject'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:285:in `filter_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:237:in`worker\_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:210:in `start_workers'"], :level=>:fatal}` ---
**Author:** ![daniellienert](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daniellienert/32/31435_2.png) [@daniellienert](https://discuss.elastic.co/u/daniellienert)\ **Post date:** [August 20, 2016, 7:09am UTC](https://discuss.elastic.co/t/logstash-5-0-alpha-4-csv-input-and-mutate-split-error/55923/4 "2016-08-20T07:09:29Z")
I experience the same issue on my setup. @tcaudrey, have you found a solution in the meantime? ---
**Author:** ![tcaudrey](https://avatars.discourse-cdn.com/v4/letter/t/71e660/32.png) [@tcaudrey](https://discuss.elastic.co/u/tcaudrey)\ **Post date:** [August 22, 2016, 5:32pm UTC](https://discuss.elastic.co/t/logstash-5-0-alpha-4-csv-input-and-mutate-split-error/55923/5 "2016-08-22T17:32:18Z")
Sort of... Apparently it's been fixed in the new version of the new mutate filter - but I'n not sure how to do the update?!?! See Here: [https://discuss.elastic.co/t/how-to-update-to-new-logstash-filter-mutate-plugin-version/58366](https://discuss.elastic.co/t/how-to-update-to-new-logstash-filter-mutate-plugin-version/58366) Ta, Tim. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:42am UTC](https://discuss.elastic.co/t/logstash-5-0-alpha-4-csv-input-and-mutate-split-error/55923/6 "2017-07-06T04:42:12Z")