Comment on page
csvparser plugin parses CSV format.
Specify time field for event time. Default is
If there is no time field in the record, this parser uses current time as an event time.
If time field value is formatted string, e.g. "28/Feb/2013:12:00:00 +0900", you need to specify this parameter to parse it.
niland it uses
Time.parsemethod to parse the field.
Specify null value pattern. Default is
If given field value is matched with this pattern, the field value is replaced with
true, empty string field is replaced with
nil. Default is
Although every parsed field has type
stringby default, you can specify other types. This is useful when filtering particular fields numerically or storing data with sensible type information.
The syntax is
As demonstrated above, "," is used to delimit field-type pairs while ":" is used to separate a field name with its intended type.
Unspecified fields are parsed at the default string type.
The list of supported types are shown below:
- integer ("int" would NOT work!)
arraytypes, there is an optional third field after the type name. For the "time" type, you can specify a time format like you would in
For the "array" type, the third field specifies the delimiter (the default is ","). For example, if a field called "item_ids" contains the value "3,4,5",
types item_ids:arrayparses it as ["3", "4", "5"]. Alternatively, if the value is "Adam|Alice|Bob",
types item_ids:array:|parses it as ["Adam", "Alice", "Bob"].
With this configuration:
This incoming event is parsed as:
1362020400 (2013/02/28/ 12:00:00)
"host" : "192.168.0.1",
"req_id" : "111",
"user" : "-"
If you set
null_value_pattern '-'in the configuration,