Parse a CSV-encoded field into known columns. It can parse values of the form:

  • value 1, value 2, value 3

  • "value 1", "value 2", value 3 (Quoted values. Quotes are optional.)

  • "value 1"; "value 2"; value 3 (Using ; as delimiter. Delimiter is configurable.)

columnsstring or arrayrequired  Names of columns to extract from field.
delimiterstringoptional[a], Delimiter character to split records by.
excludeEmptybooleanoptional[a]false If the value of a column is empty, exclude the field.
field[b]stringrequired@rawstring Field that holds the input in CSV form.

[a] Optional parameters use their default value unless explicitly set

[b] The argument name field can be omitted.

Omitted Argument Names

The argument name for field can be omitted; the following forms of this function are equivalent:




These examples show basic structure only; full examples are provided below.

For a log line like this:

2017-02-22T13:14:01.917+0000 [main thread] INFO statsModule got result="117,success,27%,3.14"

Using parseCsv(result, columns=[count, status, completion, precision, sourcetask]) will add these fields:

  • count: 117

  • status: success

  • completion: 27%

  • precision: 3.14

Sourcetask will not get assigned a value, as there were too few columns in the input for that.

Use the (unnamed) field parameter to specify which field should be CSV parsed. Specify @rawstring to parse the rawstring.

parseCsv() Examples

CSV parse the result field from a log line: statsModule got result="117,success,27%,3.14". This will add the fields count=117, status=success', completion=27%andprecision=3.14 to the event.

parseCsv(result, columns=[count, status, completion, precision, sourcetask])