outputcsv

Exports the specified fields of all input data to the CSV/TSV file.

Syntax

outputcsv [OPTIONS] FILE_PATH FIELD, ...
Required Parameters
FILE_PATH
Path to the CSV/TSV file.
FIELD, ...
Fields to be output in a CSV or TSV file, separated by a comma(,).
Caution
Both the default CSV and TSV files have fixed columns, orders, and numbers on each of their first lines, but Logpresso data may have different fields existing in each row. So please be sure to define the output fields. If you want to record data in a file without specifying an output field, refer to the 'outputjson' command.
Optional Parameters
append=BOOL

Option to enable appending data to the end of the file specified in the FILE_PATH (default: f).

  • t: Appends the field records to the end of the file specified as FILE_PATH. If the file does not exist, the file is created. You cannot set this option to t when overwrite=t.
  • f: NOT append the field records to the end of the file specified as FILE_PATH. The query fails if the file exists.
bom=BOOL

Option to enable the addition of BOM(byte order mark) to the file header (default: f).

  • t: Adds BOM to the file header
  • f: NOT add BOM to the file header.
encoding=CHARSET

Character set (default: utf-8). Use the preferred MIME name or aliases registered in the following document: http://www.iana.org/assignments/character-sets/character-sets.xhtml

flush=INT{y|mon|w|d|h|m|s}

Cycle to flush the output buffer to the file specified as FILE_PATH. You can use one of the cycle units of y (year), mon (month), w (week), d (day), h (hour), m (minute), and s (second). For example, to flush the buffer every 5 seconds, specify 5s.

overwrite=BOOL

Option to enable overwriting the file specified as FILE_PATH, if it exists (default:f).

  • t: Overwrites the file specified as FILE_PATH, if it exists. You cannot set this option to t when the append option is t.
  • f: NOT overwrite the file specified as FILE_PATH, if it exists. The query fails if the file exists.
partition=BOOL

Option to enable macro in the FILE_PATH (default: f).

  • t: Enables macro
  • f: Disables macro

You can specify FILE_PATH to change the directory and file path over time using a macro with the partition=t option. The available macros are {logtime:FMT} and {now:FMT}. For input examples, refer to Usage #2.

  • {logtime:FMT}: Names the directory or file based on the log occurrence time.
  • {now:FMT}: Names the directory or file based on the current time.
Caution
If you set 'partition=t' and do not use a macro on the path, the query fails.
tab=BOOL

Option to use tab character as a separator (default: f).

  • t: Uses tab character as a separator. This is useful for processing tab-separated values (TSV) files.
  • f: Uses comma (,) as a separator.
tmp=TMP_FILE_PATH

Path to a temporary file. Once you set this option, the command creates a temporary file and outputs the result, and moves the file to the path specified by FILE_PATH when the query finishes successfully.

Description

Usage

  1. Record src_ip and dst_ip field values in the ippair.csv file.

    outputcsv /opt/logpresso/files/ippair.csv src_ip, dst_ip
    
  2. Partition the directory according to the log occurrence date using macro, create the file name based on the current time, and then record the src_ip and dst_ip field values.

    outputcsv
        partition=t
        /opt/logpresso/files/{logtime:/yyyy/MM/dd/}/{now:HHmm}.csv
        src_ip, dst_ip