# Splitting the log into a csv file

**URL:** <https://discuss.elastic.co/t/splitting-the-log-into-a-csv-file/295922>\
**Category:** Logstash\
**Created:** [February 1, 2022, 9:45am UTC](https://discuss.elastic.co/t/splitting-the-log-into-a-csv-file/295922 "2022-02-01T09:45:15Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![PanPiotr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/panpiotr/32/100267_2.png) [@PanPiotr](https://discuss.elastic.co/u/PanPiotr)\
**Post date:** [February 1, 2022, 9:45am UTC](https://discuss.elastic.co/t/splitting-the-log-into-a-csv-file/295922/1 "2022-02-01T09:45:15Z")

</div>

Hi,  
I want to use logstash to separate the appropriate logs by a constant value appearing in these logs, and then divide the log into pieces after the separator ("|") and put it into a csv file with headers. The logs I'm looking for are recognized by the constant (WID2). I also noticed that the message pulled out by GREEDYDATA gets cut off after about 85 characters

Example log:  
2022-01-02 10:32:30,0000001 | WID2 | 3313141414 | Request | STEP\_1 | OK | Message

And i want from this logs create csv file with headers: TIMESTAMP, VALUE, MESSAGE\_TYPE, STEP, STATUS, MESSAGE. I do not want to save a constant value (WID2) in the csv file, it only serves to find my logs among others.

I wrote it but it doesn't work:

```auto
input {
 file {
  path => ["path"]
  start_position => "beginning"
  sincedb_path => "path"
 }
}

filter {
 grok {
  match => {
   "message" => "%{GREEDYDATA:SYSLOGMESSAGE}"
    }
   }
 if ([SYSLOGMESSAGE] !~ "WID2"){
  drop {}
 }
 if([SYSLOGMESSAGE] =~ 'WID2") {
  csv {
   separator => "|"
   columns => ["TIMESTAMP", "VALUE", "MESSAGE_TYPE", "STEP", "STATUS", "MESSAGE"]
  }
 }
}

output{
 file {
  path => ["path.csv"]
 }
}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 1, 2022, 6:08pm UTC](https://discuss.elastic.co/t/splitting-the-log-into-a-csv-file/295922/2 "2022-02-01T18:08:31Z")

</div>

> [@PanPiotr](#):
>
> it doesn't work

What does that mean? What results do you get and what do you not like about those results?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 1, 2022, 6:09pm UTC](https://discuss.elastic.co/t/splitting-the-log-into-a-csv-file/295922/3 "2022-03-01T18:09:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.