# Logstash 5.2 broke CSV output
**URL:** https://discuss.elastic.co/t/logstash-5-2-broke-csv-output/77053
**Category:** Logstash
**Created:** [March 1, 2017, 9:17pm UTC](https://discuss.elastic.co/t/logstash-5-2-broke-csv-output/77053 "2017-03-01T21:17:25Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@j2man](https://discuss.elastic.co/u/j2man)
#### Post date: [March 1, 2017, 9:17pm UTC](https://discuss.elastic.co/t/logstash-5-2-broke-csv-output/77053/1 "2017-03-01T21:17:25Z")
Seems that 5.2 broke the CSV output plugin. This generates a "csv" with all the message fields all the time NOT separated by comma's but spaces even though "blah" does not exist as a field. This works correctly 2.3 and broken horribly broken in 5.2.
To recreate pass in a file with this in it:
00:00:00.0 COMM\_TURNED\_ON YODA
Use this grok pattern:
EVENT\_COMM\_TURNED\_ON %{TIME:event\_time}%{SPACE}%{NOTSPACE:event\_type}%{SPACE}%{NOTSPACE:name}
input { stdin { } }
filter {
grok {
patterns\_dir =\>["C:/src/elk/broken"]
match =\>["message", "%{EVENT\_COMM\_TURNED\_ON}"]
}
}
output {
if "\_grokparsefailure" not in [tags] {
elasticsearch {
index =\> "raw-data-%{+YYYY.MM.dd}"
}
if "COMM\_TURNED\_ON" in [message] {
csv {
fields =\> ["blah"]
csv\_options =\> {"col\_sep" =\> "," "row\_sep" =\> "\r\n"}
path =\> "C:/src/elk/comm\_turned\_on.csv"
}
}
}
}
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 29, 2017, 9:17pm UTC](https://discuss.elastic.co/t/logstash-5-2-broke-csv-output/77053/2 "2017-03-29T21:17:44Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.