# Snort CSV Parsing **URL:** \ **Category:** Logstash\ **Created:** [March 14, 2018, 7:44pm UTC](https://discuss.elastic.co/t/snort-csv-parsing/123985 "2018-03-14T19:44:10Z")\ **Posts on this page:** 4\ **Page:** 1

**Author:** ![Brandonmcgr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandonmcgr/32/28789_2.png) [@Brandonmcgr](https://discuss.elastic.co/u/Brandonmcgr)\ **Post date:** [March 14, 2018, 7:44pm UTC](https://discuss.elastic.co/t/snort-csv-parsing/123985/1 "2018-03-14T19:44:10Z")

Hello, I'm working on sending my Snort logs to ELK. So far, if i send it directly to Elasticsearch. It works, but obviously with poor formatting. However, when sending it to logstash; I recieve some weird issues. Here is my logstash conf file: > input { > tcp{ > host =\> "192.168.0.36" > port =\> 5044 > codec =\> plain { > charset =\> "US-ASCII" > } > } > } > > filter { > csv { > columns =\> ["datetime","sig\_gen","sig\_id","sig\_rev","msg","proto","src\_ip","src\_port","dst\_ip","dst\_port","packet","category","priority","additional"] > } > } > > output { > elasticsearch { > hosts =\> ["192.168.0.36:9200"] > } > } Once it is received in Kibana, it is displayed as: > ``` > "message": "T��yT��\u00025��_\f�(��T�+Pe�n��J��8\u001f��\u0015ow�a1�v��8��^9V��2VJ(\u0004P�X��D��!~J�\u0018\u0014��4��Q��C��r��e�\u001f�U�\u00186\u000f��N��/FU�`8�y�4?:��", > > ``` I have ensured that the charset matches up (alert.csv in snort is: ``` > alert.csv: text/plain; charset=us-ascii ``` Finally, when logstash is running; i get the error: ``` [2018-03-14T19:34:05,131][WARN][logstash.filters.csv] Error parsing csv {:field=>"message", :source=>"�a�K%��(G�0*Q��B��I1\u0018��(��T+P�|\u0018��Q�..��$I>K��s��\u001C\f7@��g�\t\u0004��\f�\u0001�\u0002\u0001!�b��\t��e��C�\u00102\u000F�a��G�b�p;��\u000E��b��Vj�:s#V�dk�JW�r��\u00116�3��t�]�Z\u00174�Hu\u000E��$i��<�\e 1�\u000FT'$\u007F�R�-��p\u0010��'Yw)%v\v�C��\t�\u0003�\r3\u00180��#�r��\f��_s;��`W��]W��8/�\"F�\u0010��\u0018�=]3��}��p\u0019�{J_%I��\u0014\u0012��U\\\r��\u001Ak��+1\u0005 �\u0003��^s\u0012\u007F{\e��Y�O\u000F\u0014�j�.e�q`��p�U\u0000r�$�\u0016\u0019f>\u0014\a<3mx4��|\u0004x��c��r\u0006��3F\u0004[i�\u0003Z\r��\u0016�Lh�#�{��$i��\f�4�", :exception=>#} [2018-03-14T19:34:36,183][WARN][logstash.filters.csv] Error parsing csv {:field=>"message", :source=>"2W\u0000\u0000\u0000\u00052C\u0000\u0000\u0002Ix^��N�L\u0014\u0005p��]��D�\u0012\u0012��L�\t�\u0014��3�Z��fY��t\u001F\u0001��\t�/|��70\v>\u0001��^�Y�\t\u0010��\u0000\f�n\u000E\b��k��*W�E��~\u001E�a��h�]�b��i��O��BLu�S��\u000F~��u\u0018�w}\u001A^�}��%��\u001Ce�ri\\.r�\u0010e�ri\\.r)\u0010�c!XY�'\\U\\I��b;fcyL�&(>\e��h\be�� kKt��\biP�F�\u0002\u0010f�'�\eh}\u0013��^D@Xu1��\t�P/\" lB\u001F��\u0005\u0006��\\�v�n��g�", :exception=>#} [2018-03-14T19:34:36,185][WARN][logstash.filters.csv] Error parsing csv {:field=>"message", :source=>"��3f��\"{H3�\u0018m:��Q<=�r�$\u001A\u0019�}�P 9go��\b5j�[��Uz��JdK+�!Y~�/+X9vc\u0016S��?T�\u001D��\fiY��%��G\u0000\u0000\u0000��tb@�2W\u0000\u0000\u0000\u00012C\u0000\u0000\u0001�x^\u0000�\u0001\\�2J\u0000\u0000\u0000\u0001\u0000\u0000\u0001�{\"@timestamp\":\"2018-03-14T19:32:50.797Z\",\"@metadata\":{\"beat\":\"filebeat\",\"type\":\"doc\",\"version\":\"6.2.2\"},\"source\":\"/var/log/snort/alert.csv\",\"offset\":4690,\"message\":\"03/14-19:32:43.464851 ,1,1384,8,\\\"MISC UPnP malformed advertisement\\\",UDP,192.168.0.10,54819,239.255.255.250,1900,70:4D:7B:67:B4:2C,01:00:5E:7F:FF:FA,0x150,,,,,,255,0,3724,322,67588,,,,\",\"beat\":{\"version\":\"6.2.2\",\"name\":\"ids\",\"hostname\":\"ids\"}}\u0001\u0000\u0000��\u0016\u001Ap�2W\u0000\u0000\u0000\u000F2C\u0000\u0000\u0004�x^��]k\eG\u0017\a��+��\f'�sf��%Y�@� 1��<�\u0005��n��hiZ", :exception=>#} [2018-03-14T19:35:07,195][WARN][logstash.filters.csv] Error parsing csv {:field=>"message", :source=>"�BA�vx�I\u0012\"\u0005&b��9�!\u000F5zbS�\u001F��<4�FH��BDDt\u0006e�PYm\u0003\u0006��t�Q#!�J\u001D\v!�\u0013b�L��\u007Fs�]�\u0006��-L��%Sx�I\u001FqUq%_�d�&��0�/D��i/LFj�\"��v�$7�L�J��J6C��\\P�*�\u0013��c�J[C\v��\e��h\u0019^P2�J��d\u001A�x#} ``` I've tried to supply as much information as possible, if there is any more information required; please say so. ---

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 14, 2018, 8:11pm UTC](https://discuss.elastic.co/t/snort-csv-parsing/123985/2 "2018-03-14T20:11:55Z")

Have you configured filebeat writing to a tcp input? Not going to work. Replace the tcp input with a beats input. ---

**Author:** ![Brandonmcgr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandonmcgr/32/28789_2.png) [@Brandonmcgr](https://discuss.elastic.co/u/Brandonmcgr)\ **Post date:** [March 14, 2018, 8:17pm UTC](https://discuss.elastic.co/t/snort-csv-parsing/123985/3 "2018-03-14T20:17:39Z")

Youre a genius. Thank you. ---

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 11, 2018, 8:18pm UTC](https://discuss.elastic.co/t/snort-csv-parsing/123985/4 "2018-04-11T20:18:02Z")

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.