I've come accross an issue with the kv-filter plugin where if I input a file with windows line endings and the last key value pair on the line is a string with spaces, the string is not read correctly, but is instead read up until the first space, including the leading quotation mark. This only happens on lines that end with a line ending, so if there is no new line after the last line, this line will be read correctly.
- Version: Logstash 7.5.0, KV-filter 4.4.0
- Operating System: Debian 10
- Config File:
input {
file {
path => "[path to input file]"
mode => "read"
start_position => "beginning"
}
}
filter {
kv {
target => "log_params"
}
}
output {
elasticsearch {
hosts => ["localhost:9200"]
}
}
- Sample Data:
key1="string one one" key2=123 key3="string one two"
key1="string one two" key2=321 key3="string two two"
- Steps to Reproduce:
Create two files with the above sample data, one with Unix line endings and one with Windows line endings. The Unix line endings file returns (only printing output of the first line to keep it short):
log_params.key1: string one one
log_params.key2: 123
log_params.key3: string one two
The Windows file endings file returns:
log_params.key1: string one one
log_params.key2: 123
log_params.key3: "string
edit1: typo