# Trouble with CSV Converter

**URL:** <https://community.graylog.org/t/trouble-with-csv-converter/15518>\
**Category:** Graylog Central (peer support)\
**Created:** [May 20, 2020, 4:58am UTC](https://community.graylog.org/t/trouble-with-csv-converter/15518 "2020-05-20T04:58:53Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![barryCrunch](https://avatars.discourse-cdn.com/v4/letter/b/cc9497/32.png) [@barryCrunch](https://community.graylog.org/u/barryCrunch)\
**Post date:** [May 20, 2020, 4:58am UTC](https://community.graylog.org/t/trouble-with-csv-converter/15518/1 "2020-05-20T04:58:53Z")

</div>

I’m trying to generate fields based on a syslog message where a portion of it is comma delimited. I setup the column headers but when the messages pass through the extractor the only field that I see is the “breakout” field. Below is the code for the extractor.

```auto
{
  "extractors": [
    {
      "title": "Flow Extractor",
      "extractor_type": "copy_input",
      "converters": [
        {
          "type": "csv",
          "config": {
            "column_header": "time,src_ip,src_port,dst_ip,dst_port,protocol_pkts_sent,pkts_recvd,bytes_sent,bytes_recvd,dst_interface,path_id,app_name,flow_event,zbfw_rule"
          }
        }
      ],
      "order": 0,
      "cursor_strategy": "copy",
      "source_field": "message",
      "target_field": "Flow",
      "extractor_config": {},
      "condition_type": "regex",
      "condition_value": "cgxFlowLog"
    },
    {
      "title": "csv",
      "extractor_type": "copy_input",
      "converters": [
        {
          "type": "csv",
          "config": {
            "column_header": "time,src_ip,src_port,dst_ip,dst_port,protocol_pkts_sent,pkts_recvd,bytes_sent,bytes_recvd,dst_interface,path_id,app_name,flow_event,zbfw_rule"
          }
        }
      ],
      "order": 0,
      "cursor_strategy": "copy",
      "source_field": "Flow",
      "target_field": "breakout",
      "extractor_config": {},
      "condition_type": "none",
      "condition_value": ""
    }
  ],
  "version": "3.2.5"
}

```

Here is an example of a message

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/7/7eb2f156551f9336a095421aaf99c37746118e55.png)

I may be misunderstanding the CSV converter but I would have thought that the column headers would now be displayed as fields in my message.

Thank you in advance to anybody who can point me in the right direction.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [June 3, 2020, 4:58am UTC](https://community.graylog.org/t/trouble-with-csv-converter/15518/2 "2020-06-03T04:58:55Z")

</div>

Closed on June 3, 2020, 4:58am UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.