Parse a CSV-encoded field into known columns. It can parse values of the form:
value 1, value 2, value 3
"value 1", "value 2", value 3
(Quoted values. Quotes are optional.)"value 1"; "value 2"; value 3
(Using ; as delimiter. Delimiter is configurable.)
Parameter | Type | Required | Default Value | Description |
---|---|---|---|---|
columns | string or array | required | Names of columns to extract from field. | |
delimiter | string | optional[a] | , | Delimiter character to split records by. |
excludeEmpty | boolean | optional[a] | false | If the value of a column is empty, exclude the field. |
field [b] | string | required | @rawstring | Field that holds the input in CSV form. |
[a] Optional parameters use their default value unless explicitly set. |
Hide omitted argument names for this function
Omitted Argument NamesThe argument name for
field
can be omitted; the following forms of this function are equivalent:logscaleparseCsv("field",columns="value")
and:
logscaleparseCsv(field="field",columns="value")
These examples show basic structure only.
For a log line like this:
2017-02-22T13:14:01.917+0000 [main thread] INFO statsModule got result="117,success,27%,3.14"
Using parseCsv(result, columns=[count, status,
completion, precision, sourcetask])
will add these fields:
count: 117
status: success
completion: 27%
precision: 3.14
Sourcetask will not get assigned a value, as there were too few columns in the input for that.
Use the (unnamed) field
parameter to specify which
field should be CSV parsed. Specify @rawstring to
parse the rawstring.
parseCsv()
Examples
CSV parse the result field from a log line:
statsModule got
result="117,success,27%,3.14"
. This will add the fields
count=117, status=success',
completion=27%andprecision=3.14
to the event.
parseCsv(result, columns=[count, status, completion, precision, sourcetask])