*.csv
APPLICATIONID,LEVEL,ERROR
filebeat
filebeat.inputs:
- paths:
- C:\logs\*csv
input_type: log
exclude_lines: ['^APPLICATIONID']
multiline.pattern: '^\d'
multiline.negate: true
multiline.match: after
output.elasticsearch:
hosts: ["clusterurl:8888"]
index: "csvindex"
pipeline: test_pipeline
es pipleline
PUT _ingest/pipeline/test_pipeline { "processors": [ { "split": { "field": "message", "target_field": "test", "separator": "," } }, { "script": { "lang": "painless", "source": "ctx.ApplicationId = ctx.test[0];ctx.Level = ctx.test[1];ctx.Error = ctx.test[2]" } }, { "remove": { "field": ["test"] } } ] }