# Logstash 7.0.1 output to CSV empty

**URL:** <https://discuss.elastic.co/t/logstash-7-0-1-output-to-csv-empty/187377>\
**Category:** Logstash\
**Created:** [June 25, 2019, 3:53pm UTC](https://discuss.elastic.co/t/logstash-7-0-1-output-to-csv-empty/187377 "2019-06-25T15:53:27Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![etsai7](https://avatars.discourse-cdn.com/v4/letter/e/ba8739/32.png) [@etsai7](https://discuss.elastic.co/u/etsai7)\
**Post date:** [June 25, 2019, 3:53pm UTC](https://discuss.elastic.co/t/logstash-7-0-1-output-to-csv-empty/187377/1 "2019-06-25T15:53:27Z")

</div>

Edit: Never mind, I was able to figure it out. The issue was stemming from a wrong location output.

Hello,

I am trying to output Netflow data out to a csv using Logstash 7.0.1. For testing purposes, I am only including the flow.bytes field for the CSV. Here is my conf file:

```auto
input{
  elasticsearch{
    hosts => ["10.100.1.2:9200"]
    index => "elastiflow-*"
    query => '{"query": { "bool": { "must": {"match_all": {}}}}}'
  }
}

output{
  csv{
    fields => ["[flow][bytes]"]
    path => "./data/output_ElastiFlow_test.csv"
  }
}

```

Output Logs:

```auto
[testuser@mtfx2 logstash-7.0.1]$ bin/logstash -f conf_files/elastiflow-output.conf 
Sending Logstash logs to /home/testuser/Downloads/ELK/logstash-7.0.1/logs which is now configured via log4j2.properties
[2019-06-25T08:00:50,359][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2019-06-25T08:00:50,373][INFO][logstash.runner] Starting Logstash {"logstash.version"=>"7.0.1"}
[2019-06-25T08:00:55,365][INFO][logstash.javapipeline] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>20, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>2500, :thread=>"#<Thread:0x1426c965 run>"}
[2019-06-25T08:00:55,723][INFO][logstash.javapipeline] Pipeline started {"pipeline.id"=>"main"}
[2019-06-25T08:00:55,794][INFO][logstash.agent] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
[2019-06-25T08:00:56,156][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9601}
[2019-06-25T08:00:57,136][INFO][logstash.outputs.csv] Opening file {:path=>"/home/testuser/Downloads/ELK/logstash-7.0.1/data/output_ElastiFlow_test.csv"}
[2019-06-25T08:01:03,935][INFO][logstash.runner] Logstash shut down.

```

How does my configuration look?

Thanks,  
Eric

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 23, 2019, 3:53pm UTC](https://discuss.elastic.co/t/logstash-7-0-1-output-to-csv-empty/187377/2 "2019-07-23T15:53:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.