# Read a CSV in Logstash level and filter on basis of the extracted data

**URL:** https://discuss.elastic.co/t/read-a-csv-in-logstash-level-and-filter-on-basis-of-the-extracted-data/237420
**Category:** Elasticsearch
**Created:** [June 17, 2020, 8:15am UTC](https://discuss.elastic.co/t/read-a-csv-in-logstash-level-and-filter-on-basis-of-the-extracted-data/237420 "2020-06-17T08:15:42Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Gurkeerat\_Sondhi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gurkeerat_sondhi/32/68762_2.png) [@Gurkeerat\_Sondhi](https://discuss.elastic.co/u/Gurkeerat_Sondhi)
#### Post date: [June 17, 2020, 8:15am UTC](https://discuss.elastic.co/t/read-a-csv-in-logstash-level-and-filter-on-basis-of-the-extracted-data/237420/1 "2020-06-17T08:15:42Z")

</div>

I am using Metricbeat to get process-level data and push it to Elastic Search using Logstash.

Now, the aim is to categorize the processes into 2 tags i.e the process running is either a browser or it is something else.

I am able to do that statically using this block of code :

```auto
    input {
      beats {
        port => 5044
      }
    }
    filter{
        if [process][name]=="firefox.exe" or [process][name]=="chrome.exe" {
            mutate {
                add_field => { "process.type" => "browsers" }
                convert => {
                "process.type" => "string"
                }
            }
        }
        else {
            mutate {
                add_field => { "process.type" => "other" }
            } 
        }
    }

    output {
      elasticsearch {
        hosts => "localhost:9200"
        # manage_template => false
        index => "metricbeatlogstash"
      }
    }

```

But when I try to make that if condition dynamic by reading the process list from a CSV, I am not getting any valid results in Kibana, nor an error on my LogStash level.

The CSV config file code is as follows :

```auto
    input {
      beats {
        port => 5044
      }
      file{
            path=>"filePath"
            start_position=>"beginning"
            sincedb_path=>"NULL"
        }
    }
    filter{
        csv{
            separator=>","
            columns=>["processList","IT"]
        }
        if [process][name] in [processList] {
            mutate {
                add_field => { "process.type" => "browsers" }
                convert => {
                "process.type" => "string"
                }
            }
        }
        else {
            mutate {
                add_field => { "process.type" => "other" }
            } 
        }
    }

    output {
      elasticsearch {
        hosts => "localhost:9200"
        # manage_template => false
        index => "metricbeatlogstash2"
      }
    }

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 15, 2020, 8:15am UTC](https://discuss.elastic.co/t/read-a-csv-in-logstash-level-and-filter-on-basis-of-the-extracted-data/237420/2 "2020-07-15T08:15:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.