# Parse cvs file with a key and multiple values

**URL:** https://discuss.elastic.co/t/parse-cvs-file-with-a-key-and-multiple-values/129578
**Category:** Logstash
**Created:** [April 26, 2018, 3:07am UTC](https://discuss.elastic.co/t/parse-cvs-file-with-a-key-and-multiple-values/129578 "2018-04-26T03:07:58Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Steven\_Lin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steven_lin/32/42073_2.png) [@Steven\_Lin](https://discuss.elastic.co/u/Steven_Lin)
#### Post date: [April 26, 2018, 3:07am UTC](https://discuss.elastic.co/t/parse-cvs-file-with-a-key-and-multiple-values/129578/1 "2018-04-26T03:07:58Z")

</div>

Hi!  
i have a cvs file with a key and multiple value by date to show the devices status like this:  
deviceid, 2018-04-01, 2018-04-02, 2018-04-03, ...  
d001, 0, 0, 1, ...  
d002, 1, 1, 1, ...  
d003, 0, 1, 1, ...  
...

can't find the way to deal with multiple values issue for logstash.  
anyone got the solution?

Regards, Steven

---

<div class="post-metadata">

### Author: ![NerdSec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nerdsec/32/22056_2.png) [@NerdSec](https://discuss.elastic.co/u/NerdSec)
#### Post date: [April 26, 2018, 4:16am UTC](https://discuss.elastic.co/t/parse-cvs-file-with-a-key-and-multiple-values/129578/2 "2018-04-26T04:16:57Z")

</div>

Hi Steven,

Using a csv filter you can directly parse a csv. Why is there a need for using key-value logic?

[https://www.elastic.co/guide/en/logstash/current/plugins-filters-csv.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-csv.html)

---

<div class="post-metadata">

### Author: ![Steven\_Lin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steven_lin/32/42073_2.png) [@Steven\_Lin](https://discuss.elastic.co/u/Steven_Lin)
#### Post date: [April 26, 2018, 7:23am UTC](https://discuss.elastic.co/t/parse-cvs-file-with-a-key-and-multiple-values/129578/3 "2018-04-26T07:23:31Z")

</div>

Hi! NerdSec,  
Thanks for your reply to my question. i think i'm new to logstash and trying to find any helpful information to deal with the need of translating csv file data to elasticsearch. Anyway, i think i need to import and transform csv below:

> deviceid, 2018-04-01, 2018-04-02, 2018-04-03, ...  
> d001, 0, 0, 1, ...  
> d002, 1, 1, 1, ...  
> d003, 0, 1, 1, ...  
> ...

to elasticsearch of following records:

> recorddate deviceid status  
> 2018-04-01 d001 0  
> 2018-04-02 d001 0  
> 2018-04-03 d001 1  
> ...  
> 2018-04-01 d002 1  
> 2018-04-02 d002 1  
> 2018-04-03 d002 1  
> ...

then i can see the statistic chart from Kibana for the devices availability.  
Don't know how the logstash configuration file to do to this kind of transformation (the columns are not fixed, according to the number of date).  
Or maybe i miss something or misunderstand the usage of it. Any information will be appreciated, thanks.

Regards, Steven

---

<div class="post-metadata">

### Author: ![NerdSec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nerdsec/32/22056_2.png) [@NerdSec](https://discuss.elastic.co/u/NerdSec)
#### Post date: [April 26, 2018, 8:29am UTC](https://discuss.elastic.co/t/parse-cvs-file-with-a-key-and-multiple-values/129578/4 "2018-04-26T08:29:04Z")

</div>

Hi Steven,

This does not seem to be possible with any of the existing filters. You might have to either transpose the csv before processing or write a ruby code to do the same.

I am not very good at the ruby filter, maybe someone else could help.

[https://www.elastic.co/guide/en/logstash/current/plugins-filters-ruby.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-ruby.html)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 24, 2018, 8:30am UTC](https://discuss.elastic.co/t/parse-cvs-file-with-a-key-and-multiple-values/129578/5 "2018-05-24T08:30:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
