daemon \`
I'm trying this dissect:
dissect {
mapping =\> { "message" =\> "%{event\_source}:%{severity}:%{id} daemon \" }
}
but it won't work.
The \ anywhere in the string does work, but at the end it's considered to be escaping the " I guess.
And a double \\ won't work either.
How should I proceed?
Thanks a lot in advance for your help!
Vincent
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 27, 2020, 2:39pm UTC](https://discuss.elastic.co/t/dissect-with-a-backslash-at-the-end-of-the-log-line/216630/2 "2020-01-27T14:39:39Z")
Take a look at [this](https://github.com/elastic/logstash/issues/9701) issue, which I think applies to strings in general, not just regexps. The workaround is setting config.support\_escapes
---
### Author:  [@Vincent\_Maury](https://discuss.elastic.co/u/Vincent_Maury)
#### Post date: [January 27, 2020, 4:51pm UTC](https://discuss.elastic.co/t/dissect-with-a-backslash-at-the-end-of-the-log-line/216630/3 "2020-01-27T16:51:23Z")
Thank you @Badger
I enabled this setting, although i didn't read the scope of it (does it apply to the input-generator-message field? to the filter-dissect-mapping string?)
it's working when i set \\ in the middle of the string, but i'm still not able to test it at the end of the string.
See my test config:
```
input {
generator {
count => 1
message => "Bla %stuff \"January\", 15 2019 ['83.202.178.93'] and just testing spaces before an anchor and others after plus all the end\\"
}
}
filter {
dissect {
mapping => { "message" => "Bla %stuff \"%{month}\", %{day} %{year} ['%{devicehostip}'] and %{fld} an anchor and %{fld2} plus %{message}\\" }
}
}
output {
stdout {
codec => rubydebug
}
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 27, 2020, 5:46pm UTC](https://discuss.elastic.co/t/dissect-with-a-backslash-at-the-end-of-the-log-line/216630/4 "2020-01-27T17:46:05Z")
It should apply to the whole configuration. I agree that it does not seem to help here. Time for an ugly hack
```
mutate { gsub => ["message", "$", " "] }
```
Then add a space after the \ in your dissect mapping 😃
---
### Author:  [@Vincent\_Maury](https://discuss.elastic.co/u/Vincent_Maury)
#### Post date: [January 31, 2020, 10:47am UTC](https://discuss.elastic.co/t/dissect-with-a-backslash-at-the-end-of-the-log-line/216630/5 "2020-01-31T10:47:55Z")
Thanks @Badger
It's a quick hack indeed!
I hope this issue will be fixed soon 😉
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 28, 2020, 10:47am UTC](https://discuss.elastic.co/t/dissect-with-a-backslash-at-the-end-of-the-log-line/216630/6 "2020-02-28T10:47:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.