outputcsv
Exports the specified fields of all input data to the CSV/TSV file.
Syntax
Required Parameter
FILE_PATH
- Path to the CSV/TSV file.
FIELD, ...
- Fields to be output in a CSV or TSV file, separated by a comma(
,
).CautionBoth the default CSV and TSV files have fixed columns, orders, and numbers on each of their first lines, but Logpresso data may have different fields existing in each row. So please be sure to define the output fields. If you want to record data in a file without specifying an output field, refer to the 'outputjson' command.
Optional Parameter
append=BOOL
-
Option to enable appending data to the end of the file specified in the
FILE_PATH
(default:f
).t
: Appends the field records to the end of the file specified asFILE_PATH
. If the file does not exist, the file is created. You cannot set this option tot
whenoverwrite=t
.f
: NOT append the field records to the end of the file specified asFILE_PATH
. The query fails if the file exists.
bom=BOOL
-
Option to enable the addition of BOM(byte order mark) to the file header (default:
f
).t
: Adds BOM to the file headerf
: NOT add BOM to the file header.
encoding=CHARSET
-
Character set (default:
utf-8
). Use the preferred MIME name or aliases registered in the following document: http://www.iana.org/assignments/character-sets/character-sets.xhtml flush=INT{y|mon|w|d|h|m|s}
-
Cycle to flush the output buffer to the file specified as
FILE_PATH
. You can use one of the cycle units ofy
(year),mon
(month),w
(week),d
(day),h
(hour),m
(minute), ands
(second). For example, to flush the buffer every 5 seconds, specify5s
. overwrite=BOOL
-
Option to enable overwriting the file specified as
FILE_PATH
, if it exists (default:f
).t
: Overwrites the file specified asFILE_PATH
, if it exists. You cannot set this option tot
when theappend
option ist
.f
: NOT overwrite the file specified asFILE_PATH
, if it exists. The query fails if the file exists.
partition=BOOL
-
Option to enable macro in the
FILE_PATH
(default:f
).t
: Enables macrof
: Disables macro
-
You can specify
FILE_PATH
to change the directory and file path over time using a macro with thepartition=t
option. The available macros are{logtime:FMT}
and{now:FMT}
. For input examples, refer to Usage #2.{logtime:FMT}
: Names the directory or file based on the log occurrence time.{now:FMT}
: Names the directory or file based on the current time.
CautionIf you set 'partition=t' and do not use a macro on the path, the query fails.
tab=BOOL
-
Option to use tab character as a separator (default:
f
).t
: Uses tab character as a separator. This is useful for processing tab-separated values (TSV) files.f
: Uses comma (,
) as a separator.
tmp=TMP_FILE_PATH
-
Path to a temporary file. Once you set this option, the command creates a temporary file and outputs the result, and moves the file to the path specified by
FILE_PATH
when the query finishes successfully.
Usage
-
Record src_ip and dst_ip field values in the
ippair.csv
file.outputcsv /opt/logpresso/files/ippair.csv src_ip, dst_ip
-
Partition the directory according to the log occurrence date using macro, create the file name based on the current time, and then record the src_ip and dst_ip field values.
outputcsv partition=t /opt/logpresso/files/{logtime:/yyyy/MM/dd/}/{now:HHmm}.csv src_ip, dst_ip