RuntimeError: Invalid FieldReference: `[]`

Elastic Stack Logstash
1

Hi,

I have two servers running Logstash 7.10 pushing a series of CSV file into Elastic. Now I thought that both server were configured exactly the same, but it looks like they aren't as one is repeatedly giving the following error message:

[2021-07-27T15:14:09,281][WARN ][logstash.filters.csv     ][main][472a45c84ba06fa77db559f031d6a215fdfb893a9538e465d46da87f167242b1] Error parsing csv {:field=>"message", :source=>"XS2265370234.EUR.XETR,1627391805105746391,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,false,\"\",\"\",\"\",true,,22.180000,5003,22.322000,300,22.456000,300,1627378007905316285,0.000000,0,true,22.166007,22.209258,-300,0,300,ENABLED,22.178000,22.322000,0.002000,0.002000,22.178000,22.322000,300,300,ENABLED,22.094000,22.406000,0.002000,0.002000,22.090000,22.414000,3000,3000,0.010000,300,300,0.001250,0.001250,0.002800,0.001000,3000,3000,0.000000,0.000000,0.002800,0.006000,0.000000,false,ETF_UPDATE,262473,XS2265370234,EUR,XETR,0.010000,0.000000,0.002000,0.000000,0,22.987423,0.001000,false,0.000000,true,AGGRESSIVE,1000,false,false,false,false,false,false,false,false,false,false,false,false,1627391805063114727,1627391805103294127,0,0,0,0,0,0,0,0,0", :exception=>#<RuntimeError: Invalid FieldReference: `[]`>}

My config for both is as follows:

input {
  file {
    path => "/var/opt/log/instance_0/*/*/strategy_state.csv"
    start_position => "beginning"
  }
  file {
    path => "/var/opt/log/instance_1/*/*/strategy_state.csv"
    start_position => "beginning"
  }
}
filter {
        csv {
                autodetect_column_names => "true"
                separator => ","
        }
}
output {
    elasticsearch {
      hosts => ["<hostname>"]
      ssl => true
      index => "<index>"
      user => "<username>"
      password => "<password>"
      ilm_enabled => false
    }
}

I have seen a few similar topics on this, but none seem to match what I am seeing.

Thanks

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.