# Malformed csv error while reading csv file with Logstash

**URL:** https://discuss.elastic.co/t/malformed-csv-error-while-reading-csv-file-with-logstash/362601
**Category:** Logstash
**Created:** [July 5, 2024, 8:48am UTC](https://discuss.elastic.co/t/malformed-csv-error-while-reading-csv-file-with-logstash/362601 "2024-07-05T08:48:40Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Rick\_V](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rick_v/32/131683_2.png) [@Rick\_V](https://discuss.elastic.co/u/Rick_V)
#### Post date: [July 5, 2024, 8:48am UTC](https://discuss.elastic.co/t/malformed-csv-error-while-reading-csv-file-with-logstash/362601/1 "2024-07-05T08:48:40Z")

</div>

Hi all,

I try to read a .csv file using logstash, it works like a charm but for just a few lines I get the error "(MalformedCSVError) Illegal quoting in line 1."

The error occurs whenever a field contains a value with a " as value inside of it.

The inputted .csv line has the following structure:  
`field1;field2;"field3 with ""quoted"" text";field4;`

So whenever a special character is kept in a field it get enclosed in a double quote. Whenever a double qoute is kept in that same field, it will be preceeded by antoher double quote like the csv convention describes. Still I get the malformed csv error from Logstash, what is the reason the error gets thrown and how can I fix this?

Thanks in advance,  
Rick

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [July 5, 2024, 12:37pm UTC](https://discuss.elastic.co/t/malformed-csv-error-while-reading-csv-file-with-logstash/362601/2 "2024-07-05T12:37:41Z")

</div>

> [@Rick\_V](#):
>
> Still I get the malformed csv error from Logstash, what is the reason the error gets thrown and how can I fix this?

You can try to use a gsub filter to replace all double quoted in the message with a single quote, so you would end up with something like this:

> field1;field2;"field3 with 'quoted' text";field4;

This may work:

```auto
mutate {
    gsub => ["message",'""',"'"]
}

```
