Learning Elastic Stack 6.0

CSV

This plugin is used for storing output in the CSV format. The required parameters for this plugin are the path parameter, which is used to specify the location of the output file, and the other required parameter is fields, which specifies the field names from the event that should be written to the CSV file. If a field does not exist on the event, an empty string will be written. 

Let's see an example. In the following configuration, Elasticsearch is queried against the "apachelogs" index for all documents matching the statuscode:200 and the "message", "@timestamp", and "host" fields are written to a .csv file: 

#csv.confinput {
 elasticsearch {
    hosts => "localhost:9200"
    index => "apachelogs"    query => '{ "query": { "match": { "statuscode": ...