# Logstash on Windows with CSVs - Weird Behavior

**URL:** <https://discuss.elastic.co/t/logstash-on-windows-with-csvs-weird-behavior/104052>\
**Category:** Logstash\
**Created:** [October 16, 2017, 7:21am UTC](https://discuss.elastic.co/t/logstash-on-windows-with-csvs-weird-behavior/104052 "2017-10-16T07:21:01Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ahaw021](https://avatars.discourse-cdn.com/v4/letter/a/d78d45/32.png) [@ahaw021](https://discuss.elastic.co/u/ahaw021)\
**Post date:** [October 16, 2017, 7:21am UTC](https://discuss.elastic.co/t/logstash-on-windows-with-csvs-weird-behavior/104052/1 "2017-10-16T07:21:01Z")

</div>

Hi All

I hope I am having a 1d10t error but thought I would ask anyway.

I have downloaded a bunch of CSV files which sit on a folder (in my case: E:\GITHUB\SPLUNK-ELK-CERTIFICATE-TRANSPARENCY\playground\NEWBIE)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/1/e1806d94ac5c1232b1673d369633e1062fa008f5.png)

I have configured logstash using the parameters below (CSV plugin is installed)

```
> input {
> file {
> path => "E:\GITHUB\SPLUNK-ELK-CERTIFICATE-TRANSPARENCY\playground\NEWBIE\*.csv"
> ignore_older => 0
> }
> }
> filter {
> csv {
> separator => ","
> columns => ["ct_logname","cert_index","chain_hash","cert_der","all_domains","not_before","not_after"]
> }
> }
> output {
> elasticsearch {
> hosts => "http://localhost:9200"
> index => "certificates"
> }
> stdout {}
> }

```

if i run this without debug i get the following happening

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/9/196359da3fc8232a3de2d706d5f259dcc8e81ea7.png)

If i run with debug I get the following error messages

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/7/478e09d608411d3d0a2608dde662496efa54e8b3.png)

no index is created:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/0/0052eb568c5ad9e505e7c42ef939ea4017b4d78d.png)

---

<div class="post-metadata">

**Author:** ![ahaw021](https://avatars.discourse-cdn.com/v4/letter/a/d78d45/32.png) [@ahaw021](https://discuss.elastic.co/u/ahaw021)\
**Post date:** [October 16, 2017, 7:25am UTC](https://discuss.elastic.co/t/logstash-on-windows-with-csvs-weird-behavior/104052/2 "2017-10-16T07:25:40Z")

</div>

if i then change the config file to take things from stdin

I have no issues

```
> input {
> stdin{}
> 
> }
> filter {
> csv {
> separator => ","
> columns => ["ct_logname","cert_index","chain_hash","cert_der","all_domains","not_before","not_after"]
> }
> }
> output {
> elasticsearch {
> hosts => "http://localhost:9200"
> index => "certificates"
> }
> stdout {}
> }

```

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/8/b80b74ed15f1b5cc5afe0ac9cb61281c7dc889ef.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/5/f54fea1b2f0e743cb4768546cbb9555c30924ea1.png)

I think it's something wrong with the file/folder syntax but i can't figure out what

I am suspecting it's not the CSV parser as it's working as expected with STDIN input

---

<div class="post-metadata">

**Author:** ![ahaw021](https://avatars.discourse-cdn.com/v4/letter/a/d78d45/32.png) [@ahaw021](https://discuss.elastic.co/u/ahaw021)\
**Post date:** [October 17, 2017, 7:37am UTC](https://discuss.elastic.co/t/logstash-on-windows-with-csvs-weird-behavior/104052/3 "2017-10-17T07:37:26Z")

</div>

Solved - it was a sincedb related issue

How i fixed it - put a static path to a file and deleted the contents before a run

```
input {
  file {
    path => ["E:\GITHUB\SPLUNK-ELK-CERTIFICATE-TRANSPARENCY\playground\NEWBIE\*.csv"]
	ignore_older => 0
	start_position => "beginning"
	sincedb_path => "path/sincedb.txt"
   }
}
filter {
  csv {
      separator => ","
      columns => ["ct_logname","cert_index","chain_hash","cert_der","all_domains","not_before","not_after"]
  }
}
output {
   elasticsearch {
     index => "certificates_better"
	 }
	stdout {}
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 14, 2017, 7:38am UTC](https://discuss.elastic.co/t/logstash-on-windows-with-csvs-weird-behavior/104052/4 "2017-11-14T07:38:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.