如何从CSV读取和写入其他CSV文件取决于使用logstash的最后一列值

我是个新手。 我有一个CSV文件包含以下数据

22,10.10.193.170,172.23.3.42,NULL,3740,NULL,NULL,NULL,NULL,1
54,10.35.92.87,172.23.3.41,NULL,10492,NULL,NULL,NULL,NULL,2
28,10.34.20.97,172.23.3.42,NULL,7265,NULL,NULL,NULL,NULL,3
24,10.1.160.225,172.23.3.48,NULL,3780,NULL,NULL,NULL,NULL,1
54,10.1.160.225,172.23.3.48,NULL,10463,NULL,NULL,NULL,NULL,1
18,175.100.160.70,104.124.54.17,NULL,9515,NULL,NULL,NULL,NULL,2
2,172.16.3.87,203.175.185.57,NULL,44,NULL,NULL,NULL,NULL,3
10,172.16.4.68,10.1.15.220,NULL,184,NULL,NULL,NULL,NULL,1
26,10.121.6.170,172.23.3.48,NULL,3827,NULL,NULL,NULL,NULL,2
26,10.121.6.134,172.23.3.50,NULL,3764,NULL,NULL,NULL,NULL,1

我想读取CSV文件，并根据最后一列的值将数据写入相应的CSV文件 与输出一样，csv应包含

22,10.10.193.170,172.23.3.42,NULL,3740,NULL,NULL,NULL,NULL,1
24,10.1.160.225,172.23.3.48,NULL,3780,NULL,NULL,NULL,NULL,1
10,172.16.4.68,10.1.15.220,NULL,184,NULL,NULL,NULL,NULL,1
26,10.121.6.134,172.23.3.50,NULL,3764,NULL,NULL,NULL,NULL,1

54,10.35.92.87,172.23.3.41,NULL,10492,NULL,NULL,NULL,NULL,2
18,175.100.160.70,104.124.54.17,NULL,9515,NULL,NULL,NULL,NULL,2
26,10.121.6.170,172.23.3.48,NULL,3827,NULL,NULL,NULL,NULL,2

在输出_2.csv中应包含

22,10.10.193.170,172.23.3.42,NULL,3740,NULL,NULL,NULL,NULL,1
24,10.1.160.225,172.23.3.48,NULL,3780,NULL,NULL,NULL,NULL,1
10,172.16.4.68,10.1.15.220,NULL,184,NULL,NULL,NULL,NULL,1
26,10.121.6.134,172.23.3.50,NULL,3764,NULL,NULL,NULL,NULL,1

54,10.35.92.87,172.23.3.41,NULL,10492,NULL,NULL,NULL,NULL,2
18,175.100.160.70,104.124.54.17,NULL,9515,NULL,NULL,NULL,NULL,2
26,10.121.6.170,172.23.3.48,NULL,3827,NULL,NULL,NULL,NULL,2

和输出_3.csv包含

28,10.34.20.97,172.23.3.42,NULL,7265,NULL,NULL,NULL,NULL,3
2,172.16.3.87,203.175.185.57,NULL,44,NULL,NULL,NULL,NULL,3

请帮我解决以上问题

问候,，

---

Vikas

您可以像这样使用CSV过滤器

input {
    file {
        path => "/path/of/your/csv/test.csv"
        sincedb_path => "/path/of/your/csv/test.idx"
        start_position => "beginning"
    }
}

filter {
    csv {
        separator => ","
        columns => ["column1","column2",...]
    }
}

output {

    if [column1] == "value" {
        csv {
        fields => ["column1"]
        path => "/path/to/your/csv"
       }
    }
 }