Parse String as CSV

Parse a CSV-encoded field into known columns using parseCsv() function

Query

logscale
kvParse()
| parseCsv(result, columns=[count, status,
          completion, precision, sourcetask])

Introduction

The parseCsv() function can be used to Parse a CSV-encoded field into known columns.

Example incoming data might look like this:

Raw Events
2017-02-22T13:14:01.917+0000 [main thread] INFO statsModule got result="117 ,success ,27% ,3.14"

Step-by-Step

  1. Starting with the source repository events.

  2. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1[\Add Field/] result{{Result Set}} repo --> 0 0 --> 1 1 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;
    logscale
    kvParse()

    Parses the string into key value pairs.

  3. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1[\Add Field/] result{{Result Set}} repo --> 0 0 --> 1 1 --> result style 1 fill:#ff0000,stroke-width:4px,stroke:#000;
    logscale
    | parseCsv(result, columns=[count, status,
          completion, precision, sourcetask])

    CSV parses the result field from a log line (extracted by the kvParse() function) and adds the following fields to the event: count with the value 117, status with the value success, completion with the value 27%, and precision with the value 3.14.

  4. Event Result set.

Summary and Results

The query is used to parse a string as CSV.

Sample output from the incoming example data:

completioncountprecisionresultstatus
27% 117 3.14 117 ,success ,27% ,3.14 success