CSV Router Preprocessor#
The CSV router preprocessor can route entries to different tags based on the contents of a specified CSV column in the entry. The configuration specifies a column index (zero indexed), the contents of which are then tested against user-defined routing rules.
The CSV Router preprocessor Type is
Route-Extraction(int, required): This parameter specifies the column index (beginning with 0) of the CSV which will contain the string used to compare against routes.
Route(string, required): At least one
Routedefinition is required. This consists of two strings separated by a colon, e.g.
Route=sshd:sshlogtag. The first string (‘sshd’) is matched against the value extracted via
Route-Extraction, and the second string defines the name of the tag to which matching entries should be routed. If the second string is left blank, entries matching the first string will be dropped.
Drop-Misses(boolean, optional): By default, entries which are not valid CSV or do not contain enough columns to extract the
Route-Extractioncolumn will be passed through unmodified. Setting
Drop-Missesto true will make the ingester drop any entries which 1) are not valid CSV, or 2) do not contain enough columns to extract the
Example: Routing based on the Third Column#
Given the input:
We can use the CSV router to route entries based on the user role, located in the 3rd column of the CSV.
Below is a partial Simple Relay configuration that will route the above CSV to two different tags, based on the contents of the 3rd column.
[Listener "csv"] Bind-String="0.0.0.0:2601" #we are binding to all interfaces, with TCP implied Tag-Name=default Preprocessor=role [preprocessor "role"] Type = csvrouter Drop-Misses=false Route-Extraction=2 # csv is zero-indexed, so 2 is the 3rd column Route=employee:csvemployees Route=boss:csvbosses