# Logstash csv filter plugin, with mariadb audit plugin logs

**URL:** <https://discuss.elastic.co/t/logstash-csv-filter-plugin-with-mariadb-audit-plugin-logs/242953>\
**Category:** Logstash\
**Created:** [July 28, 2020, 5:24pm UTC](https://discuss.elastic.co/t/logstash-csv-filter-plugin-with-mariadb-audit-plugin-logs/242953 "2020-07-28T17:24:50Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![fabrizio73](https://avatars.discourse-cdn.com/v4/letter/f/ecccb3/32.png) [@fabrizio73](https://discuss.elastic.co/u/fabrizio73)\
**Post date:** [July 29, 2020, 8:31am UTC](https://discuss.elastic.co/t/logstash-csv-filter-plugin-with-mariadb-audit-plugin-logs/242953/3 "2020-07-29T08:31:21Z")

</div>

Hi,  
here is our configuration and how data are INGESTED, in this case I have used mutate BEFORE the filter to convert commas with semicolon, , I've tried also AFTER the filter, obtaining the "message" filed apparently correct, but the object is interupted and broken in multiple columns exactly like this.

filter {  
mutate {  
gsub =\> [  
'message', ",", ";"  
]  
}  
csv {  
separator =\> ";"  
columns =\> ["timestamp","serverhost","username","host","connectionid","queryid","operation","database","object","retcode"]  
}

```
}

```

{  
"\_index": "logstash-2020.07.28",  
"\_type": "doc",  
"\_id": "\_WiplXMBt5BZnqx7LsLv",  
"\_version": 1,  
"\_score": null,  
"\_source": {  
"beat": {  
"hostname": "mbc-db-vodafone",  
"version": "6.3.2",  
"name": "mbc-db-vodafone"  
},  
"connectionid": "464232271",  
"column28": " \'FISSI E MOBILI NAZIONALI SENZA LIMITI\'",  
"column41": " \'NO\')'",  
"column27": " \'13\'",  
"column29": " \'-\'",  
"source": "/var/lib/mysql/server\_audit.log",  
"input": {  
"type": "log"  
},  
"column19": " `iccid_sim`",  
"column33": " \'-\'",  
"column34": " \'\'",  
"column21": " `piano_telefonico_sim`",  
"@timestamp": "2020-07-28T13:43:23.779Z",  
"column11": " `id_promo`",  
"offset": 3792527,  
"prospector": {  
"type": "log"  
},  
"message": "20200728 15:43:23;mbc-db-vodafone;root;192.168.2.165;464232271;9113436875;QUERY;vodafone\_en;'INSERT INTO `tb_promo_attivate` (`id_customer`; `id_phone_calls`; `id_promo`; `descrizione_promo`; `costo_promo`; `id_agent_crm`; `nome_agent`; `telefono_sconto`; `tipo_scelta_sim`; `numero_sim`; `iccid_sim`; `vecchio_gestore_sim`; `piano_telefonico_sim`; `data_inserimento`; `campagna`;`tipo`; `scelta_rete_sicura`)\n\t\tVALUES (\'13285100\'; \'0\'; \'13\'; \'FISSI E MOBILI NAZIONALI SENZA LIMITI\'; \'-\'; \'83\'; \'Ledda Marcellino\'; \'\'; \'-\'; \'\'; \'\'; \'-\'; \'-\'; CURRENT\_TIMESTAMP; \'Richiami su Numeri Uscenti C2C 4u Italia\';\'DSL\'; \'NO\')';0",  
"username": "root",  
"column16": " `telefono_sconto`",  
"column15": " `nome_agent`",  
"column14": " `id_agent_crm`",  
"column26": " \'0\'",  
"column13": " `costo_promo`",  
"serverhost": "mbc-db-vodafone",  
"column38": " CURRENT\_TIMESTAMP",  
"tags": [  
"beats\_input\_codec\_plain\_applied"  
],  
"retcode": " `id_phone_calls`",  
"object": "'INSERT INTO `tb_promo_attivate` (`id_customer`",  
"column23": " `campagna`",  
"@version": "1",  
"column31": " \'XXXXXXXXXXX\'",  
"queryid": "9113436875",  
"column32": " \'\'",  
"operation": "QUERY",  
"column25": " `scelta_rete_sicura`)\n\t\tVALUES (\'13285100\'",  
"column40": "\'DSL\'",  
"column37": " \'-\'",  
"database": "vodafone\_en",  
"column22": " `data_inserimento`",  
"column35": " \'\'",  
"column20": " `vecchio_gestore_sim`",  
"column24": "`tipo`",  
"column30": " \'83\'",  
"column42": "0",  
"host": "192.168.2.165",  
"timestamp": "20200728 15:43:23",  
"column39": " \'Richiami su Numeri Uscenti XXXXXXXX\'",  
"column17": " `tipo_scelta_sim`",  
"column36": " \'-\'",  
"column18": " `numero_sim`",  
"column12": " `descrizione_promo`"  
},  
"fields": {  
"@timestamp": [  
"2020-07-28T13:43:23.779Z"  
]  
},  
"highlight": {  
"message": [  
"20200728 15:43:23;mbc-db-vodafone;root;192.168.2.165;464232271;9113436875;QUERY;vodafone\_en;'@kibana-highlighted-field@INSERT@/kibana-highlighted-field@ INTO `tb_promo_attivate` (`id_customer`; `id_phone_calls`; `id_promo`; `descrizione_promo`; `costo_promo`; `id_agent_crm`; `nome_agent`; `telefono_sconto`; `tipo_scelta_sim`; `numero_sim`; `iccid_sim`; `vecchio_gestore_sim`; `piano_telefonico_sim`; `data_inserimento`; `campagna`;`tipo`; `scelta_rete_sicura`)\n\t\tVALUES (\'13285100\'; \'0\'; \'13\'; \'FISSI E MOBILI NAZIONALI SENZA LIMITI\'; \'-\'; \'83\'; \'XXXXXXXXX\'; \'\'; \'-\'; \'\'; \'\'; \'-\'; \'-\'; CURRENT\_TIMESTAMP; \'Richiami su Numeri Uscenti XXXXXXX\';\'DSL\'; \'NO\')';0"  
],  
"operation": [  
"@kibana-highlighted-field@QUERY@/kibana-highlighted-field@"  
],  
"object": [  
"'@kibana-highlighted-field@INSERT@/kibana-highlighted-field@ INTO `tb_promo_attivate` (`id_customer`"  
]  
},  
"sort": [  
1595943803779  
]  
}

---

_[View the full topic](https://discuss.elastic.co/t/logstash-csv-filter-plugin-with-mariadb-audit-plugin-logs/242953)._