# Use the right codec field "date"

**URL:** <https://discuss.elastic.co/t/use-the-right-codec-field-date/235751>\
**Category:** Logstash\
**Created:** [June 4, 2020, 12:33pm UTC](https://discuss.elastic.co/t/use-the-right-codec-field-date/235751 "2020-06-04T12:33:30Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![souma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/souma/32/44739_2.png) [@souma](https://discuss.elastic.co/u/souma)\
**Post date:** [June 4, 2020, 12:33pm UTC](https://discuss.elastic.co/t/use-the-right-codec-field-date/235751/1 "2020-06-04T12:33:30Z")

</div>

Hi everyone,  
i use the logstash file below to send data to elasticsearch.

```auto
input{
    file{
      path => "C:/Users/SOUMAYA/Desktop/bureau.csv"
      start_position => "beginning"
      sincedb_path => "NUL"
      codec => plain { charset => "CP1252" }
    }
}
filter{
    csv {
        separator => ";"
        convert => {
            "longitude" => "float"
            "latitude" => "float"
        } 
        
    }
    date { match => ["time", "dd MMM yy HH:mm:ss"] }

    mutate{ add_field => { "location" => "%{latitude},%{longitude}" } }
  
}

output{
    elasticsearch { 
        action => "index"
        hosts => ["http://localhost:9200/"] 
        index => "bureau"
  }
  stdout { codec => rubydebug }
}

```

The problem is that the data are saved in a messy way and the field's labels are saved as column1 ,column2 instead of the field's real labels.  
This is a capture from elasticsearch .

 ![elastic](https://us1.discourse-cdn.com/elastic/original/3X/6/6/66080251b9a89476fefe1f89b2417a49748df71f.png)  
Also, here is capture of the data file(in format xlsx just to have a clear view) ![eeee](https://us1.discourse-cdn.com/elastic/original/3X/a/5/a5b9c869e8ffe09de47e6a417f99c3513c6a9f07.png) ).

Could you please help me.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [June 4, 2020, 7:51pm UTC](https://discuss.elastic.co/t/use-the-right-codec-field-date/235751/2 "2020-06-04T19:51:15Z")

</div>

Bonsoir !

It's because you did not defined the header names. [Documentation](https://www.elastic.co/guide/en/logstash/current/plugins-filters-csv.html#_description_117) says (emphasis is mine):

> The CSV filter takes an event field containing CSV data, parses it, and stores it as individual fields with **optionally-specified** field names. This filter can parse data with any separator, not just commas.

Have a look at those options:

- [Csv filter plugin | Logstash Reference [8.11] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-filters-csv.html#plugins-filters-csv-autodetect_column_names)
- [Csv filter plugin | Logstash Reference [8.11] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-filters-csv.html#plugins-filters-csv-columns)

BTW I moved your question to #Logstash

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 2, 2020, 7:51pm UTC](https://discuss.elastic.co/t/use-the-right-codec-field-date/235751/3 "2020-07-02T19:51:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.