search

humio / issues

Issue Tracker for Humio
4 stars 2 forks source link

Documentation request - build parser for CSV #63

Closed dsmath closed 5 years ago

dsmath commented 5 years ago

Parser documentation has several examples of unstructured and JSON based data sources. An example parser for a CSV data source in the documentation would be helpful for those of us with lesser regex skills.

mwl commented 5 years ago

Hi @dsmath. Good input, I'm happy to write up something for you, but in the meantime here's something you could work with.

Given the following event

2019-01-02T08:00:42.001Z;foo;bar;baz

You can parse it up with the following parser

splitString(field=@rawstring, by=";")
| parseTimestamp(field=_splitstring[0])
| drop(_splitstring[0])
| rename(field=_splitstring[1], as=first)
| rename(field=_splitstring[2], as=second)
| rename(field=_splitstring[3], as=third)

Which will give you three fields

henrikjohansen commented 5 years ago

Implemented in v1.2.8 ...

anagrius commented 5 years ago

Closing because it has been implemented. Please reopen if you disagree.