This plugin is used for storing output in the CSV format. The required parameters for this plugin are the path parameter, which is used to specify the location of the output file, and fields, which specifies the field names from the event that should be written to the CSV file. If a field does not exist on the event, an empty string will be written. 

Let's look at an example. In the following configuration, Elasticsearch is queried against the apachelogs index for all documents matching statuscode:200, and the message, @timestamp, and host fields are written to a .csv file: 

#csv.conf

input {
 elasticsearch {
    hosts => "localhost:9200"
    index => "apachelogs"
    query => '{ "query": { "match": { "statuscode": 200 } }}'
 } 
} 
output {  
    csv { 
     fields => ["message", "@timestamp","host"]
     path => "D:eslogsexport.csv"   
    } 
}