# Logstash import CSV data classification
**URL:** https://discuss.elastic.co/t/logstash-import-csv-data-classification/255362
**Category:** Logstash
**Created:** [November 13, 2020, 3:53pm UTC](https://discuss.elastic.co/t/logstash-import-csv-data-classification/255362 "2020-11-13T15:53:05Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@stevezemlicka](https://discuss.elastic.co/u/stevezemlicka)
#### Post date: [November 13, 2020, 3:53pm UTC](https://discuss.elastic.co/t/logstash-import-csv-data-classification/255362/1 "2020-11-13T15:53:05Z")
First off, I am relatively inexperienced with ELK and am trying to perform a demo of ELK because I'm convinced it is a powerful and useful application for much of our work. I have been presented with a CSV export of data and am trying to get it brought into Elasticsearch using Logstash and think I am having trouble primarily with the data classification (particularly with the timestamp).
raw-data:
> 128797847,33299,1,2019,7,1,0,0.9204,"142322T11 ",30,"N ","A ",101,1.0000,10.0,1
> 128797847,33299,1,2019,7,1,1,1.2078,"142322T11 ",30,"N ","A ",101,1.0000,10.0,1
Reformated time to ISO8601 and moved to the front:
> 2019-7-1T0,128797847,33299,1,0.9204,"142322T11 ",30,"N ","A ",101,1.0000,10.0
> 2019-7-1T1,128797847,33299,1,1.2078,"142322T11 ",30,"N ","A ",101,1.0000,10.0
My config so far just brings in all the data generically which is a good first step but is obviously inefficient and somewhat unusable. My initial config is as follows:
> input {
> file {
> path =\> "/home/user/userdata/data.csv"
> start\_position =\>"beginning"
> sincedb\_path =\> "/dev/null"
> }
> }
>
> filter {
> csv {
> columns =\> [
> "date",
> "User",
> "Group",
> "Org",
> "Data",
> "Info1",
> "Info2",
> "Info3",
> "Info4",
> "Info5",
> "Info6",
> "Info7"
> ]
> separator =\> ","
> }
> }
> output {
> elasticsearch {
> action =\> "index"
> hosts =\> ["[http://localhost:9200](http://localhost:9200)"]
> index =\> "user-data"
> }
> }
How do I get the time column categorized as a date field and mappable to the @timestamp when generating the index pattern? I'd also like to categorize the other fields a bit more efficiently so any suggestions on that would be appreciated too.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 13, 2020, 4:46pm UTC](https://discuss.elastic.co/t/logstash-import-csv-data-classification/255362/2 "2020-11-13T16:46:02Z")
> [@stevezemlicka](#):
>
> 2019-7-1T1
What does the number after the T mean?
---
### Author:  [@stevezemlicka](https://discuss.elastic.co/u/stevezemlicka)
#### Post date: [November 13, 2020, 5:03pm UTC](https://discuss.elastic.co/t/logstash-import-csv-data-classification/255362/3 "2020-11-13T17:03:47Z")
I thought that was necessary for the ISO standard but I have restructured just to remove the T and put a space between the day and the Hour. So in the example you listed "2019-7-1T1" Now looks like "2019-7-1 1" and that references July 1 2019 @ 1am.
I am experimenting with the following code in the conf file and I think i got it to work once but subsequent logstash calls have failed to add the index as expected so I may have to backtrack a bit:
> ```
> "mappings":{
> "date":{"type":"date","format":"yyyy-M-d H"}
> }
>
> ```
Edit:Corrected the date format with the correct day form...though it is still not working.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 13, 2020, 6:13pm UTC](https://discuss.elastic.co/t/logstash-import-csv-data-classification/255362/4 "2020-11-13T18:13:12Z")
That is one approach, another is to use a date filter
```
date { match => ["date", "yyyy-M-d H"] }
```
That will overwrite the @timestamp field. Even if you set the target to be another field name, that field will automatically be created as a date in elasticsearch provided it has not already been created with some other type (elasticsearch tries to do [date detection](https://www.elastic.co/guide/en/elasticsearch/reference/current/dynamic-field-mapping.html#date-detection) when it indexes a string field for the first time).
---
### Author:  [@stevezemlicka](https://discuss.elastic.co/u/stevezemlicka)
#### Post date: [November 13, 2020, 7:59pm UTC](https://discuss.elastic.co/t/logstash-import-csv-data-classification/255362/5 "2020-11-13T19:59:07Z")
@Badger
That worked well in my test data. However, I noticed the data size was growing much faster than expected and I think my next challenge will be specifying appropriate attributes to the other datasets. But I'll start a different thread for that. Thank you for your help!!!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 11, 2020, 7:59pm UTC](https://discuss.elastic.co/t/logstash-import-csv-data-classification/255362/6 "2020-12-11T19:59:31Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.