Failed in loading csv data to Elasticsearch, translation issue

Question

I am trying to import CSV file to elastic file, but it is failed and threw an error

Pipeline aborted due to error {:pipeline_id=>"main", :exception=>#, :backtrace=>["/usr/local/Cellar/logstash/7.6.1/libexec/vendor/bundle/jruby/2.5.0/gems/logstash-filter-mutate-3.5.0/lib/logstash/filters/mutate.rb:222:in block in register'", "org/jruby/RubyHash.java:1428:ineach'", "/usr/local/Cellar/logstash/7.6.1/libexec/vendor/bundle/jruby/2.5.0/gems/logstash-filter-mutate-3.5.0/lib/logstash/filters/mutate.rb:220:in register'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:56:inregister'", "/usr/local/Cellar/logstash/7.6.1/libexec/logstash-core/lib/logstash/java_pipeline.rb:200:in block in register_plugins'", "org/jruby/RubyArray.java:1814:ineach'", "/usr/local/Cellar/logstash/7.6.1/libexec/logstash-core/lib/logstash/java_pipeline.rb:199:in register_plugins'", "/usr/local/Cellar/logstash/7.6.1/libexec/logstash-core/lib/logstash/java_pipeline.rb:502:inmaybe_setup_out_plugins'", "/usr/local/Cellar/logstash/7.6.1/libexec/logstash-core/lib/logstash/java_pipeline.rb:212:in start_workers'", "/usr/local/Cellar/logstash/7.6.1/libexec/logstash-core/lib/logstash/java_pipeline.rb:154:inrun'", "/usr/local/Cellar/logstash/7.6.1/libexec/logstash-core/lib/logstash/java_pipeline.rb:109:in `block in start'"], "pipeline.sources"=>["/Users/user/Document/Esk-Data/xudaxia.conf"], :thread=>"#"}

Below is the conf file

input
{
    file{
    path => ["/test.csv"]
    start_position => "beginning"
    }
}
filter{
    csv{
        separator => ","
         columns => ["comment_time","comment", "id", "video_time"]
       }
    mutate{
        convert => {
            "comment_time" => "date_time"
            "comment" => "string"
            "id" => "integer"
            "video_time" => "float"
      }
    }
}
output{
    elasticsearch{
        hosts => ["localhost:9200"]
        index => "test"
    }
}

test.csv

comment_time         comment        id        video_time
2020/03/22 15:59:41  バイ             a        123.100
2020/03/22 15:59:45  บาย             b        100.100
2020/04/22 15:59:50  ByeBye          c        80.210

can anyone help?

Lupanoide Lupanoide · Accepted Answer · 2020-03-28T16:41:47

According the documentation the option date_time doesn't exist for convert action on mutate plugin - doc here. However this plugin is used to cast a type into another one, that it isn't your use case. If comment_time is not recognized as date field you should trasform it with date plugin - doc here.

So you should remove this block:

mutate{
    convert => {
        "comment_time" => "date_time"
        "comment" => "string"
        "id" => "integer"
        "video_time" => "float"
  }
}

and replace it with this one:

date {
    match => [ "comment_time", "yyyy/MM/dd HH:mm:ss"
}

Failed in loading csv data to Elasticsearch, translation issue

1 Answers