parseCsv( ) Query Function

Parse a CSV-encoded field into known columns. It can parse values of the form:

  • value 1,value 2,value 3
  • “value 1”,“value 2”,value 3 (Quoted values. Quotes are optional.)
  • “value 1”;“value 2”;value 3 (Using ; as delimiter. Delimiter is configurable.)

For a log line like this:

2017-02-22T13:14:01.917+0000 [main thread] INFO statsModule got result="117,succes,27%,3.14"

Using parseCsv(result, columns=[count, status, completion, precision, sourcetask]) will add these fields:

  • count: 117
  • status: succes
  • completion: 27%
  • precision: 3.14

Sourcetask will not get assigned a value, as these were too few columns in the input for that.

Use the (unnamed) field parameter to specify which field should be CSV parsed. Specify @rawstring to parse the rawstring

Parameters

Name Type Required Default Description
field string No @rawstring Field that holds the input in CSV form
columns [string] Yes Names of columns to extract from field
delimiter string No , Delimiter character to split records by
excludeEmpty bool No false If the value of a column is empty, exclude the field

field is the unnamed parameter.

Examples

CSV parse the result field from a log line: statsModule got result="117,succes,27%,3.14”. This will add the fields count=117, status=succes’, completion=27%andprecision=3.14`to the event.

parseCsv(result, columns=[count, status, completion, precision, sourcetask])