# Simple string and Time stamp parse also redirect to CSV file

**URL:** <https://discuss.elastic.co/t/simple-string-and-time-stamp-parse-also-redirect-to-csv-file/93948>\
**Category:** Logstash\
**Created:** [July 20, 2017, 1:23pm UTC](https://discuss.elastic.co/t/simple-string-and-time-stamp-parse-also-redirect-to-csv-file/93948 "2017-07-20T13:23:57Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![krishna1](https://avatars.discourse-cdn.com/v4/letter/k/71e660/32.png) [@krishna1](https://discuss.elastic.co/u/krishna1)\
**Post date:** [July 20, 2017, 1:23pm UTC](https://discuss.elastic.co/t/simple-string-and-time-stamp-parse-also-redirect-to-csv-file/93948/1 "2017-07-20T13:23:57Z")

</div>

Dear Folks,

Recently I've started using logstash for parsing the logs, Please help on syntax for parsing the log in for CSV file.

ex:

[Wed May 10 17:18:03.391 2017] PassportMain 17:17:59.319: tvp[tvp\_CloseCam/5211](0x8a, ref:0x314): Calling

Expecting CSV Format:

time\_stamp(1st col) message(2nd col)  
Wed May 10 17:18:03.391 2017(1st col) vp[tvp\_CloseCam/5211](0x8a, ref:0x314): Calling (2nd col)

input{  
file{  
path=\>   
start\_position =\> "beginning"  
sincedb\_path =\> "/dev/null"  
}  
filter{  
#suggestion/help required  
grok{match =\> { "message" =\> "tvp\_\*" }}  
}  
output{  
csv{  
fields =\>["timevalue","functionName"]  
path =\>   
}  
}

Thanks in Advance

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 17, 2017, 1:24pm UTC](https://discuss.elastic.co/t/simple-string-and-time-stamp-parse-also-redirect-to-csv-file/93948/2 "2017-08-17T13:24:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.