Double quotes inside field: grok failure / unable to remove

Elastic Stack Logstash
1

I have a message like this:

result=accept, user=username, extip=1.2.3.4, nasip=5.6.7.8, realm=user(realm)"Tue Mar 31 16:59:24 2020"4KalZzYgN, internalevent=

I am filtering like follows

kv {
  source => "msg"
  field_split => ","
}

mutate {
  gsub => [
    "realm", "\"", ""
  ]
}
grok {
  match => {
    "realm" => '\((?<realmx>.*)\)'
  }
}
if [realmx] {
  mutate {
    replace => {
      "realm" => "%{realmx}"
    }
  }
}

I have tried getting rid of the double quotes in the "realm" field. But it just won't remove them and also grok fails, probably because of the quotes.

In the end all I want to do is extract the string between parentheses.

How do I tackle this?

Thanks,
Marki

2

There are spaces in your key names

    " nasip" => "5.6.7.8",
    " realm" => "user(realm)\"Tue Mar 31 16:59:24 2020\"4KalZzYgN",

add

trim_key => " "

to your kv filter.

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.