Parse a CSV-encoded field into known columns. It can parse values of the form:

  • value 1, value 2, value 3

  • "value 1", "value 2", value 3 (Quoted values. Quotes are optional.)

  • "value 1"; "value 2"; value 3 (Using ; as delimiter. Delimiter is configurable.)

ParameterTypeRequiredDefault ValueDescription
columnsstring or arrayrequired  Names of columns to extract from field.
delimiterstringoptional[a], Delimiter character to split records by.
excludeEmptybooleanoptional[a]false If the value of a column is empty, exclude the field.
field[b]stringrequired@rawstring Field that holds the input in CSV form.
trimbooleanoptional[a]false Allows to ignore whitespace before and after values. If the value is quoted, the quotes can start after the spaces. Useful for parsing data created by sources that do not adhere to the CSV standard.

[a] Optional parameters use their default value unless explicitly set.

[b] The argument name field can be omitted.

Hide omitted argument names for this function

Show omitted argument names for this function

For a log line like this:

logscale
2017-02-22T13:14:01.917+0000 [main thread] INFO statsModule got result="117,success,27%,3.14"

Using parseCsv(result, columns=[count, status, completion, precision, sourcetask]) will add these fields:

  • count: 117

  • status: success

  • completion: 27%

  • precision: 3.14

Sourcetask will not get assigned a value, as there were too few columns in the input for that.

Use the (unnamed) field parameter to specify which field should be CSV parsed. Specify @rawstring to parse the rawstring.

parseCsv() Examples

CSV parse the result field from a log line: statsModule got result="117,success,27%,3.14". This will add the fields count=117, status=success', completion=27%andprecision=3.14 to the event.

logscale
parseCsv(result, columns=[count, status, completion, precision, sourcetask])