# Logstash - Problem when index first line of a csv file with "?"

**URL:** <https://discuss.elastic.co/t/logstash-problem-when-index-first-line-of-a-csv-file-with/52098>\
**Category:** Logstash\
**Created:** [June 7, 2016, 3:01pm UTC](https://discuss.elastic.co/t/logstash-problem-when-index-first-line-of-a-csv-file-with/52098 "2016-06-07T15:01:54Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![pittoch](https://avatars.discourse-cdn.com/v4/letter/p/df788c/32.png) [@pittoch](https://discuss.elastic.co/u/pittoch)\
**Post date:** [June 7, 2016, 3:01pm UTC](https://discuss.elastic.co/t/logstash-problem-when-index-first-line-of-a-csv-file-with/52098/1 "2016-06-07T15:01:55Z")

</div>

Hi,

Whenever I index a CSV file , the first line is preceded by a question mark "?". So my date is not properly indexed.

> "Date": "?2015-01-01 01:00:00",

So the date is not correctly read:

> ttags \_dateparsefailure

and the timestamp is false:

> @timestamp June 7th 2016, 16:12:11.845

Example:

> {  
> "\_index": "index\_capa\_planning",  
> "\_type": "core2",  
> "\_id": "AVUrNNqXfO\_P\_5NSnB1k",  
> "\_score": null,  
> "\_source": {  
> "message": "?2015-01-01 01:00:00;CR;2;480;A\r",  
> "@version": "1",  
> "@timestamp": "2016-06-07T14:12:11.845Z",  
> "path": "E:\\TDB\Datasource\capa\_planning.csv",  
> "host": "test",  
> "type": "core2",  
> "Date": "?2015-01-01 01:00:00",  
> "LPAR": "CR",  
> "NB\_DRIVE": 2,  
> "GB\_SAVED": 480,  
> "SALLE": "A",  
> "tags": [  
> "\_dateparsefailure"  
> ]  
> },  
> "fields": {  
> "@timestamp": [  
> 1465308731845  
> ]  
> },  
> "sort": [  
> 1465308731845  
> ]  
> }

Can help me ?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 10, 2016, 5:38am UTC](https://discuss.elastic.co/t/logstash-problem-when-index-first-line-of-a-csv-file-with/52098/2 "2016-06-10T05:38:16Z")

</div>

What does your filter configuration look like?

---

<div class="post-metadata">

**Author:** ![pittoch](https://avatars.discourse-cdn.com/v4/letter/p/df788c/32.png) [@pittoch](https://discuss.elastic.co/u/pittoch)\
**Post date:** [June 14, 2016, 3:58pm UTC](https://discuss.elastic.co/t/logstash-problem-when-index-first-line-of-a-csv-file-with/52098/3 "2016-06-14T15:58:01Z")

</div>

> [@pittoch](#):
>
> }

My logstash configuration is:

 ![](https://us1.discourse-cdn.com/elastic/original/2X/9/91ab144e2c301ed29120253bceb3ad81b262f889.png)

I suspect that the problem is caused by a powershelll command that I used to write my csv source:  
If I used write-content I don't have problem  
I I used out-file command I have problem...

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 14, 2016, 4:56pm UTC](https://discuss.elastic.co/t/logstash-problem-when-index-first-line-of-a-csv-file-with/52098/4 "2016-06-14T16:56:57Z")

</div>

See [http://stackoverflow.com/questions/5596982/using-powershell-to-write-a-file-in-utf-8-without-the-bom](http://stackoverflow.com/questions/5596982/using-powershell-to-write-a-file-in-utf-8-without-the-bom).

---

<div class="post-metadata">

**Author:** ![pittoch](https://avatars.discourse-cdn.com/v4/letter/p/df788c/32.png) [@pittoch](https://discuss.elastic.co/u/pittoch)\
**Post date:** [June 16, 2016, 12:05pm UTC](https://discuss.elastic.co/t/logstash-problem-when-index-first-line-of-a-csv-file-with/52098/5 "2016-06-16T12:05:57Z")

</div>

Thank you !

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:52am UTC](https://discuss.elastic.co/t/logstash-problem-when-index-first-line-of-a-csv-file-with/52098/6 "2017-07-06T04:52:30Z")

</div>

Closed on July 6, 2017, 4:52am UTC