CSV

Parse Elastic Compatible

Synopsis

Parses CSV (Comma-Separated Values) data from a field and assigns the extracted values to specified target fields.

Schema

- csv:
    field: <ident>
    target_fields: <ident[]>
    description: <text>
    empty_value: <string>
    if: <script>
    ignore_failure: <boolean>
    ignore_missing: <boolean>
    on_failure: <processor[]>
    on_success: <processor[]>
    quote: <char>
    separator: <char>
    tag: <string>
    trim: <boolean>

Configuration

The following fields are used to define the processor:

Field	Required	Default	Description
field	Y	-	Field containing the CSV string to parse
target_fields	Y	-	Array of field names to assign the parsed values to
description	N	-	Explanatory note
empty_value	N	-	Value to use for empty fields. If not specified, empty fields remain empty
if	N	-	Condition to run
ignore_failure	N	false	Continue processing if parsing fails
ignore_missing	N	false	Skip processing if source field doesn't exist
on_failure	N	-	See Handling Failures
on_success	N	-	See Handling Success
quote	N	"	Accepted but not applied. The parser always uses the double quote; this value is never read
separator	N	,	Character used to separate fields
tag	N	-	Identifier
disabled	N	false	When true, the processor is skipped and the event continues to the next one. Lets you take a processor out of the path without removing its configuration
trim	N	false	Trim whitespace from each parsed field. The whole line is trimmed either way — this option controls only the individual values

Details

The processor reads a single line of CSV data and maps each field to the corresponding target field. It can handle quoted values, custom separators, quote characters, and provides options for trimming whitespace and handling empty fields.

note

The processor expects the CSV data to be a single line. For multi-line CSV processing, consider using other processors, or pre-processing the data first.

warning

If the number of fields in the CSV data is less than the number of target fields, the processor will fail unless ignore_missing is set to true.

Examples

Basic

Parsing simple quoted CSV data...	{ "csv_data": "\"x\", \"y\", \"z\"" } - csv: field: csv_data target_fields: ["A", "B", "C"] trim: true
creates the specified fields:	{ "csv_data": "\"x\", \"y\", \"z\"", "A": "x", "B": "y", "C": "z" }

Empty Values

Filling empty fields with default values...	{ "csv_data": "x,,z" } - csv: field: csv_data target_fields: ["A", "B", "C"] empty_value: "N/A"
result:	{ "csv_data": "x,,z", "A": "x", "B": "N/A", "C": "z" }

Custom Separator

Using semicolon as the separator...	{ "csv_data": "x;y;z" } - csv: field: csv_data target_fields: ["A", "B", "C"] separator: ";"
result:	{ "csv_data": "x;y;z", "A": "x", "B": "y", "C": "z" }