# Use Logstash CSV module to move columns **URL:** \ **Category:** Logstash\ **Created:** [January 8, 2019, 2:30pm UTC](https://discuss.elastic.co/t/use-logstash-csv-module-to-move-columns/163383 "2019-01-08T14:30:50Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Hamil](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hamil/32/39569_2.png) [@Hamil](https://discuss.elastic.co/u/Hamil)\ **Post date:** [January 8, 2019, 2:30pm UTC](https://discuss.elastic.co/t/use-logstash-csv-module-to-move-columns/163383/1 "2019-01-08T14:30:50Z")
I am using Logstash to grab a file from a monitored folder to import my Symantec WSS (Bluecoat) Cloud Proxy logs. I have looked at and used the information from the following two old (but still very useful) websites: > **[ELK Stack and Blue Coat Logs – Airman – Medium](https://medium.com/@airman604/elk-stack-and-blue-coat-logs-d3a5415f767a)** > > Have been experimenting lately with using ELK stack to process Blue Coat web surfing logs. ELK is Elasticsearch + Logstash + Kibana… > **[BlueCoat Proxy log search and analytics with ELK](http://christophe.vandeplas.com/2014/07/bluecoat-proxy-log-search-and-analytics.html)** > > This is an article of a series to show the power of Elasticsearch , Kibana and Logstash ( ELK ) in the domain of Incident Handling and fo... Everything works properly and my logs are parsing as they should but I need the ability to change the locations of some of the columns in order to export the data to my SIEM in a compatible format. If I was using a Bluecoat ProxySG, then I could select which headers to include and the location of the columns. However, with the Cloud Proxy, you only get an hourly dump of the logs with the columns setup in a specific manner; which I cannot change nor can the Cloud Provider. ##Current CSV config to grab Column Headers filter { csv { columns =\> ["timestamp","user,account","result,source\_ip","service","geoip\_organization","geoip\_country\_code","geoip\_country\_name","geoip\_city","geoip\_region"] separator =\> "," } } I need something that can take the above columns and the 'cut' them to a different location location: item in 'Column B or 2' is 'cut and pasted' to 'Column A or 1'. I am currently using a VERY rudimentary Powershell script that calls Excel (which you technically should not do) to modify the columns in VB and and then re-saves the document with the columns in the proper location. Even with Error-Checking, this script is not reliable and I would like to use the ELK stack to process these logs as I need them. Any help or pointers with this would be greatly beneficial and if it is not possible with Logstash's CSV module, please let me know. Thank you ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [January 8, 2019, 3:15pm UTC](https://discuss.elastic.co/t/use-logstash-csv-module-to-move-columns/163383/2 "2019-01-08T15:15:24Z")
I do not understand the ask. The fields on an event are not ordered. It is essentially a hash, and you should not rely on the order in which fields are returned by the iterator of a hash, so you should rely on the order of fields in any output. ---
**Author:** ![Hamil](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hamil/32/39569_2.png) [@Hamil](https://discuss.elastic.co/u/Hamil)\ **Post date:** [January 8, 2019, 3:57pm UTC](https://discuss.elastic.co/t/use-logstash-csv-module-to-move-columns/163383/3 "2019-01-08T15:57:37Z")
Thank you for your reply... I have not outputted the columns hash in the outputs section; nor did I know you could. I will have to look at the documentation on the output order of fields in the documentation. If any one has any examples, that is always helpful. Thank you ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 5, 2019, 3:57pm UTC](https://discuss.elastic.co/t/use-logstash-csv-module-to-move-columns/163383/4 "2019-02-05T15:57:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.