Unable to filter csv file

HI,

New to ELK

please help me to understand below error
when i try to run logstash.conf file

[ERROR] 2018-07-23 11:26:37.161 [Converge PipelineAction::Create] csv - Unknown setting 'seperator' for csv
[ERROR] 2018-07-23 11:26:37.176 [Converge PipelineAction::Create] csv - Unknown setting 'column' for csv
[ERROR] 2018-07-23 11:26:37.287 [Converge PipelineAction::Create] agent - Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Something is wrong with your configuration.", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/config/mixin.rb:89:in config_init'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:128:ininitialize'", "/usr/share/logstash/logstash-core/lib/logstash/plugins/plugin_factory.rb:36:in filter_delegator'", "/usr/share/logstash/logstash-core/lib/logstash/plugins/plugin_factory.rb:95:inplugin'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:110:in plugin'", "(eval):12:in'", "org/jruby/RubyKernel.java:994:in eval'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:82:ininitialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:167:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:40:inexecute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:305:in `block in converge_state'"]}

my logstash.conf file is as below:

input{
file{
path => "/home/santra/change_requests_V2-2018-06-26_02_15_02.csv"
start_position => "beginning"
sincedb_path => "/dev/null"
}
}
filter{
csv{
seperator => ","
column => ["company","number","requested_by","u_category","u_rfc","u_device_ref_1","u_service_impact","u_urgency_lead_time","requested_by_date","sys_created_on","closed_at","u_stagestate","u_machx_case_reference","sys_updated_on","sys_updated_by","requested_by.company","sys_created_by","opened_at","opened_by","closed_by","u_machx_success_date","u_change_ack_time","u_change_successful","u_device_1","u_device_ref_2","u_device_2","u_device_ref_3","u_device_3","u_device_ref_4","u_device_4","u_device_ref_5","u_device_5","u_device_ref_6",""]
}
}
output {
elasticsearch {
hosts => "http://localhost:9200"
index => "CR"
}
stdout {codec => rubydebug}
}

Change column to columns and seperator to separator.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.