Logstash pipeline configuration - split CSV columns into multiple events

logstash-split-csv-columns-multiple-events.md

CSV Sample

col1,col2,col3
0,1,2
3,4,5
6,7,8

Code

input {
	file {
		path => "file.csv"
		start_position => "beginning"
		sincedb_path => "/dev/null"
	}
}

filter {
	csv { autodetect_column_names => true }
	ruby {
		code => "
		event.set('type', [
			'col1',
			'col2',
			'col3'
		])"
	}
  
	split { field => "type" }

	if [type] == "col1" and [col1] { mutate { add_field => { "value" => "%{col1}" } } }
	else if [type] == "col2" and [col2] { mutate { add_field => { "value" => "%{col2}" } } }
        else if [type] == "col3" and [col3] { mutate { add_field => { "value" => "%{col3}" } } }
}


output {
	stdout { codec => rubydebug }
}