Hi,
In the csv output plugin documentation, you can read this about the fields option :
If a field does not exist on the event, an empty string will be written. Supports field reference syntax eg: fields => ["field1", "[nested][field]"].
So in your case, to take into account nested fields, your fields option should be like this :
fields => ["@timestamp","[event][dataset]","[host][mac]","[host][hostname]","[host][os][name]","[host][ip]","[log][file][path]","message","[service][type]"]
If the result does not change, it means that your nested fields do not exist.
Cad.