# Logstash influxdb

**URL:** https://discuss.elastic.co/t/logstash-influxdb/72175
**Category:** Logstash
**Created:** [January 19, 2017, 2:06pm UTC](https://discuss.elastic.co/t/logstash-influxdb/72175 "2017-01-19T14:06:46Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![irom77](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/irom77/32/12976_2.png) [@irom77](https://discuss.elastic.co/u/irom77)
#### Post date: [January 19, 2017, 2:06pm UTC](https://discuss.elastic.co/t/logstash-influxdb/72175/1 "2017-01-19T14:06:46Z")

</div>

Having problems with setup of logstash-output-influxdb. My config is below:

```
input {
    udp {
            port => 11514
            type => "threat"          
    }
   
}
filter {
        if [type] =="threat" {

                grok {
                #patterns_dir =>"/opt/logstash/patterns"
                        match => ["message","%<%{POSINT}>%{MONTH} %{MONTHDAY} %{TIME} %{GREEDYDATA:message}"]
                }                
                csv {
                    source => "message"
                    columns => ["Column1", "Column2", "Column3"]]
               }               

       }       
}
output {
        if [type] =="threat" {                
                influxdb {
                  data_points => {'pt1' => "Column1", 'pt2' => "Column2", 'pt3' = "Column3"} 
                  host => "10.10.10.1" 
                  db => "syslog"
                  user => "user"
                  password => "password"
                }
        }
        
}

```

getting error "Expected one of #, {, } ... data\_points =\> {"column1" =\> "SourceAddress""

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 19, 2017, 2:34pm UTC](https://discuss.elastic.co/t/logstash-influxdb/72175/2 "2017-01-19T14:34:31Z")

</div>

Drop the commas between the hash items, i.e.

```
data_points => {'pt1' => "Column1" 'pt2' => "Column2" 'pt3' = "Column3"} 

```

and not

```
data_points => {'pt1' => "Column1", 'pt2' => "Column2", 'pt3' = "Column3"}
```

---

<div class="post-metadata">

### Author: ![irom77](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/irom77/32/12976_2.png) [@irom77](https://discuss.elastic.co/u/irom77)
#### Post date: [January 19, 2017, 5:19pm UTC](https://discuss.elastic.co/t/logstash-influxdb/72175/3 "2017-01-19T17:19:27Z")

</div>

Appreciate ! Now I receive data in InfluxDB but they are just strings Column1 , 2 and 3. How to get real data from csv ?

> ## select \* from logstash name: logstash
> 
> time pt1 pt2 pt3  
> 1484845074857000000 Column1 Column2 Column3  
> 1484845074859000000 Column1 Column2 Column3  
> 1484845075690000000 Column1 Column2 Column3

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 19, 2017, 7:01pm UTC](https://discuss.elastic.co/t/logstash-influxdb/72175/4 "2017-01-19T19:01:20Z")

</div>

Use `%{Column1}` instead of `Column1`.

[https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references)

---

<div class="post-metadata">

### Author: ![irom77](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/irom77/32/12976_2.png) [@irom77](https://discuss.elastic.co/u/irom77)
#### Post date: [January 19, 2017, 8:30pm UTC](https://discuss.elastic.co/t/logstash-influxdb/72175/5 "2017-01-19T20:30:03Z")

</div>

Wow ! That is great help, thank you

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 16, 2017, 8:30pm UTC](https://discuss.elastic.co/t/logstash-influxdb/72175/6 "2017-02-16T20:30:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.