Dissect filter not removing whitespace padding via suffix "->"

Elastic Stack Beats
1

I was under the impression that the suffix -> would remove all whitespace padding to the right of my field.

Ex.
"value": "some_value ‌‌ ‌‌ ‌‌ ‌‌ "
Would become
"value": "some_value"

Either that assumption is incorrect or the suffix -> does not work properly to remove whitespace if there is a non-whitespace character separating the fields.

Example:
Log file:
some_date | some_value ‌‌ ‌‌ ‌‌ ‌‌ | some_text

Filebeat config:

processors: 
-  dissect: 
 ‌‌ ‌ ‌‌  tokenizer: "%{date} | %{value->} | %{text}

Results:
"date": "some_date"
"value": "some_value ‌‌ ‌‌ ‌‌ ‌‌ "
"text": "some_text"

I believe this config should remove the whitespace padding to the right of the "value" field but it does not.

Note: I have inserted invisible characters into the example above because the elastic discussion parser removed the duplicated spaces automatically. The actual files that I am operating on do not have invisible characters.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.