# Parsing csv file through Logstash

**URL:** <https://discuss.elastic.co/t/parsing-csv-file-through-logstash/274792>\
**Category:** Logstash\
**Created:** [June 2, 2021, 6:26pm UTC](https://discuss.elastic.co/t/parsing-csv-file-through-logstash/274792 "2021-06-02T18:26:55Z")\
**Posts on this page:** 1\
**Showing post:** 10

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 4, 2021, 7:58pm UTC](https://discuss.elastic.co/t/parsing-csv-file-through-logstash/274792/10 "2021-06-04T19:58:27Z")

</div>

But if serverName is the key then where does the value go? Here is one option for what you could do -- one event per server. Change the json filter to store the parsed data in [@metadata] and then use ruby

```
    json { source => "[@metadata][userCalls]" target => "[@metadata][parsedUserCalls]" }
    json { source => "[@metadata][totalCalls]" target => "[@metadata][parsedTotalCalls]" }
    ruby {
        code => '
            a = []
            userCalls = event.get("[@metadata][parsedUserCalls]")
            totalCalls = event.get("[@metadata][parsedTotalCalls]")
            totalCalls.each { |k, v|
                server = {}
                server["serverName"] = k
                server["totalCalls"] = v
                server["userCalls"] = userCalls[k]
                a << server
            }
            event.set("servers", a)
        '
    }

```

That will get you

```
   "servers" => [
    [0] {
         "userCalls" => {},
        "serverName" => "CiCServer-20210701:20210930",
        "totalCalls" => 0
    },
    [1] {
         "userCalls" => {
            "empty" => 3.0,
            "fqenv" => 3.0
        },
        "serverName" => "gccdServer",
        "totalCalls" => 6
    },

```

etc. You might want to use a split filter to separate each filter into its own event, and then use [this](https://discuss.elastic.co/t/how-to-dynamically-move-nested-key-value-to-root-level/180006/2) to move the contents of [server] to the root.

But do not let my guesses drive your data design. You need to describe exactly how you want they keys and values to appear.

---

_[View the full topic](https://discuss.elastic.co/t/parsing-csv-file-through-logstash/274792)._